Magma Mobile Management Entity Null Pointer Dereference Vulnerability via S1AP E-RAB Modification Indication Packet

A null pointer dereference vulnerability has been identified in the Mobile Management Entity (MME) of Magma versions through 1.8.0. This vulnerability allows network-adjacent attackers to crash the MME by sending an S1AP 'E-RAB Modification Indication' packet that omits the required 'eNB_UE_S1AP_ID' field. The issue has been fixed in Magma version 1.9.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by crashing the Mobility Management Entity (MME), disrupting all cellular communications in the affected area.

Reproduction

To reproduce this vulnerability, send an S1AP 'E-RAB Modification Indication' packet to the Magma MME that is missing the 'eNB_UE_S1AP_ID' field. This can be done by an unauthenticated mobile device or over the Internet, taking advantage of Wi-Fi Calling services.

Remediation

Users can upgrade to Magma version 1.9 or later to address this vulnerability.