Description

A security flaw has been discovered in Linux Foundation Magma 1.9.0. This impacts an unknown function of the component NGSetupRequest Handler. Performing a manipulation of the argument NG-IoT-DefaultPagingDRX results in improper input validation. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-30T16:16:43.847Z",
  "pubdate": "2026-08-30T16:16:43.847Z",
  "executiveSummary": "A critical vulnerability has been identified in the Linux Foundation Magma 1.9.0 platform, specifically within the NGSetupRequest Handler component. The flaw manifests as an improper input validation vulnerability related to the handling of the NG-IoT-DefaultPagingDRX argument.\nThis vulnerability allows remote, unauthenticated attackers to supply maliciously crafted input to the NGSetupRequest process, potentially leading to unauthorized system behavior or service degradation. As the exploit is currently publicly available, the risk to production environments is elevated.\nThe inability to properly sanitize or validate the NG-IoT-DefaultPagingDRX parameter during the NG Setup procedure exposes the core network functions to remote exploitation. Given the lack of a vendor response to the initial disclosure, systems currently running version 1.9.0 remain at significant risk until manual hardening or compensatory controls are implemented.",
  "technicalDetails": "The vulnerability resides within the NGSetupRequest Handler of the Linux Foundation Magma 1.9.0 distribution. The root cause is categorized as an improper input validation flaw affecting the processing logic of the NG-IoT-DefaultPagingDRX information element (IE).\nIn the context of 5G core network operations, the NGSetupRequest message is a fundamental procedure used by the gNodeB (gNB) to establish an association with the Access and Mobility Management Function (AMF). The Magma implementation fails to adequately enforce constraints on the NG-IoT-DefaultPagingDRX parameter, which governs the discontinuous reception (DRX) cycle for IoT devices.\nThe attack flow begins with a remote actor crafting a malicious NGSetupRequest message. By injecting non-compliant or unexpected values into the NG-IoT-DefaultPagingDRX field, the attacker bypasses standard input validation routines. Because the handler does not perform strict schema validation or range checking on this parameter, the malformed data is processed by the internal state machine. This can lead to memory corruption, unexpected termination of the handler service, or the triggering of erroneous state transitions within the AMF.\nThe vulnerability is remotely exploitable without requiring prior authentication or specific privilege levels, as the NGSetupRequest is a preliminary handshake message. The exploit, which is publicly disclosed, leverages this lack of sanitization to potentially achieve remote code execution (RCE) or denial-of-service (DoS) conditions depending on how the underlying memory buffer handles the overflow or invalid state data.\nPost-exploitation, an attacker could potentially disrupt signaling traffic, cause cascading failures in the AMF, or exploit memory safety issues to gain further access to the control plane. The lack of robust input validation mechanisms effectively allows for the injection of arbitrary data into the signal parsing path, which is a critical exposure for telecommunications infrastructure."
}