Magma Mobile Management Entity Null Pointer Dereference Vulnerability via S1AP eNB Configuration Transfer Packet

A null pointer dereference vulnerability has been identified in the Mobile Management Entity (MME) of Magma versions through 1.8.0. This vulnerability allows network-adjacent attackers to crash the MME by sending an S1AP 'eNB Configuration Transfer' packet that omits the required 'Target eNB ID' field. The issue has been fixed in Magma version 1.9.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by crashing the affected MME.

Reproduction

To reproduce this vulnerability, send an S1AP 'eNB Configuration Transfer' packet to the Magma MME. Ensure that the packet is missing the 'Target eNB ID' field. This can be done by using a software-defined radio (SDR) or, due to a recent change in how these packets are handled, by sending the packet over the Internet.

Remediation

Users can upgrade to Magma version 1.9 or later to address this vulnerability.