Description

A weakness has been identified in Linux Foundation Magma 1.9.0. Affected is an unknown function of the file ngap_amf_handlers.c of the component NGSetup Handler. Executing a manipulation can lead to state issue. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-30T17:16:38.687Z",
  "pubdate": "2026-08-30T17:16:38.687Z",
  "executiveSummary": "A critical state manipulation vulnerability has been identified within the NGSetup Handler component of Linux Foundation Magma version 1.9.0. The vulnerability resides in the ngap_amf_handlers.c file, where improper handling of NGAP (NG Application Protocol) signaling allows for unauthorized state modification.\nThis flaw can be triggered remotely, enabling a network-based attacker to manipulate the internal state of the Access and Mobility Management Function (AMF) without requiring prior authentication. Successful exploitation leads to a state issue, which can result in service disruption, session hijacking, or denial-of-service conditions within the core network architecture.\nGiven that proof-of-concept exploit code is publicly available, the risk of exploitation is significantly elevated. Organizations deploying Magma 1.9.0 should treat this as a high-priority security issue, as it permits unauthorized influence over critical telecommunications signaling processes.",
  "technicalDetails": "The vulnerability is localized within the NGSetup Handler component, specifically within the processing logic housed in ngap_amf_handlers.c. The root cause pertains to improper validation and handling of NGAP signaling messages during the NG Setup procedure. In the 3GPP 5G core network architecture, the NG Setup procedure is fundamental for establishing the interface between the Radio Access Network (RAN) and the Access and Mobility Management Function (AMF).\nThe manipulation occurs because the AMF implementation fails to correctly verify the state transition logic when receiving maliciously crafted NGAP messages. An attacker can send a sequence of NG Setup Requests that bypasses standard state machine checks. By exploiting the logic flow in ngap_amf_handlers.c, the attacker can force the AMF into an inconsistent or undefined operational state. This is categorized as a state manipulation vulnerability, where the integrity of the signaling state machine is compromised.\nFrom an attack flow perspective, the exploitation process is as follows: 1) The attacker initiates a connection to the AMF over the N2 interface using the NGAP protocol. 2) The attacker transmits a specifically crafted NGSetup Request packet containing parameters designed to trigger the identified flaw in the message handler. 3) The ngap_amf_handlers.c module processes the message without performing adequate state validation or boundary checks. 4) The internal state machine of the AMF transitions into an invalid or 'stuck' state, effectively disrupting the signaling capability for legitimate gNodeBs (gNBs).\nBecause the vulnerability is exploitable remotely over the N2 interface, an attacker with network reach to the AMF can perform this attack without needing valid credentials or elevated privileges within the core network. The post-exploitation impact includes the potential for a complete Denial of Service (DoS) for connected UEs (User Equipment) and base stations, as the AMF is rendered incapable of processing valid signaling procedures while in the manipulated state. Furthermore, if the state manipulation allows for arbitrary data injection, it may lead to further protocol-level vulnerabilities that could jeopardize broader network security and session integrity."
}