Commit Graph

2 Commits

Author SHA1 Message Date
Sukchan Lee a1a0a8c0a6 [MME] Race condition between S1AP and S6A
Assume the UE has Attached, the session has been created,
and is in the IDLE state with the UEContextRelease process.

This could result in the following call flow.

1. TAU request without Integrity Protected
2. Authentication request/response
3. Security-mode command/complete

MME can be performed simultaneously by the HSS(S6A) and UE(S1AP).

Update-Location-Request
Service request
Service reject
Delete Session Request
Delete Session Response
Update-Location-Answer
UEContextReleaseCommand for Service reject
TAU reject
UEContextReleaseCommand for TAU reject
UEContextReleaseComplete
UEContextReleaseComplete

MME crashes when UE sends a service request(S1AP) during ULR/ULA(S6A) with HSS,
which has been fixed.
2024-03-16 23:08:07 +09:00
Sukchan Lee 5764f7267d Fixed security vulnerability for malformed packet 2023-07-26 16:32:46 +09:00