Magma Mobile Management Entity Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in the Mobile Management Entity (MME) component of Magma versions through 1.8.0. This vulnerability allows network-adjacent attackers to crash the MME by sending an S1AP 'Uplink NAS Transport' packet that omits the required 'MME_UE_S1AP_ID' field. The issue has been fixed in Magma version 1.9.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the MME to crash and disrupt cellular communications managed by the MME.

Reproduction

To reproduce this vulnerability, send an S1AP 'Uplink NAS Transport' packet to the Magma MME that is missing the 'MME_UE_S1AP_ID' field. This can be done by an unauthenticated mobile device or an entity on the Internet, taking advantage of Wi-Fi Calling services.

Remediation

Users can upgrade to Magma version 1.9 or later, where this vulnerability has been fixed.