The Linux Foundation Magma Buffer Overflow Vulnerability in Protocol Configuration Options Decoding

A buffer overflow vulnerability has been identified in The Linux Foundation Magma version 1.8.0 and earlier. This issue arises in the 'decode_protocol_configuration_options' function within the file '3gpp_24.008_sm_ies.c'. The vulnerability allows attackers to cause a denial-of-service (DoS) by sending a crafted NAS packet, leading to a service disruption in cellular communications.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, disrupting all cellular communications, including phone calls, messaging, and data services, at a city-wide level.

Reproduction

To reproduce this vulnerability, send an 'Initial UE Message' S1AP packet containing a malformed 'Protocol Configuration Options' field to the AMF. This can be done by establishing a connection to the AMF over the N2 interface and transmitting the crafted packet.

Remediation

Users can upgrade to Magma version 1.9 or later, where this vulnerability has been fixed.