Magma Linked TI IE NAS Packet Vulnerability Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in Magma versions through 1.8.0. The issue arises in the 'decode_linked_ti_ie' function, where a reachable assertion can be triggered by sending a crafted NAS packet that includes a malformed Linked TI Information Element. This vulnerability can cause the Access and Mobility Management Function (AMF) to crash, disrupting cellular services.

Impact

Exploitation of this vulnerability leads to a crash of the Access and Mobility Management Function (AMF), causing a denial-of-service condition that disrupts cellular services.

Reproduction

The vulnerability can be reproduced by sending an 'Initial UE Message' S1AP packet that contains a malformed Linked TI Information Element. This can be done by establishing a connection to the AMF and transmitting the crafted packet over the N2 interface.

Remediation

Users can upgrade to Magma version 1.9.0 or later, where this vulnerability has been fixed.