The Linux Foundation Magma Stack Overflow Vulnerability in Protocol Configuration Options Decoding

A stack overflow vulnerability has been identified in The Linux Foundation Magma versions through 1.8.0. This issue arises in the 'decode_protocol_configuration_options' function within the file '3gpp/3gpp_24.008_sm_ies.c'. The vulnerability allows attackers to cause a denial-of-service (DoS) by sending a crafted NAS packet, leading to a stack overflow condition.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to arbitrary code execution or a crash of the application.

Reproduction

To reproduce this vulnerability, send an 'Initial UE Message' S1AP packet containing a malformed 'Protocol Configuration Options' field to the Magma AMF. The crafted packet should exploit the lack of proper bounds checking in the 'decode_protocol_configuration_options' function, causing a stack overflow.

Remediation

Users can upgrade to Magma version 1.9 or later, where this vulnerability has been fixed.