Magma Oversized NAS Packet Vulnerability Leading to Assertion-Based Denial-of-Service

A denial-of-service vulnerability has been identified in Magma versions through 1.8.0. When the MME receives an oversized NAS packet, it triggers an assertion failure, causing a crash. This issue can be exploited by an attacker using a compromised base station or an unauthenticated cellphone within range of the base station, leading to a persistent disruption of cellular services.

Impact

Exploitation of this vulnerability causes the MME to crash, disrupting all cellular communications, including phone calls, messaging, and data services, at a city-wide level.

Reproduction

The vulnerability can be reproduced by sending an oversized NAS packet to the MME. This can be done using a compromised base station or an unauthenticated cellphone within range of a base station managed by the MME.

Remediation

Users can upgrade to Magma version 1.9.0 or later, where this vulnerability has been fixed.