CVE-2023-37002
📋 TL;DR
This vulnerability allows remote attackers to cause denial of service in Open5GS MME by sending specially crafted ASN.1 packets over the S1AP interface. The missing MME_UE_S1AP_ID field triggers an assertion failure that crashes the MME service. Mobile network operators using vulnerable Open5GS deployments are affected.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Sustained MME crashes could disrupt cellular service for an entire coverage area, preventing users from making/receiving calls and data connections.
Likely Case
Intermittent service disruptions affecting subsets of users as MME restarts, with potential for cascading failures in the mobile core network.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and restart of affected services.
🎯 Exploit Status
Exploitation requires network access to S1AP interface but no authentication. Simple malformed packet construction needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5
Vendor Advisory: https://github.com/open5gs/open5gs/releases/tag/v2.6.5
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Open5GS to version 2.6.5 or later. 3. Restart MME service. 4. Verify service is running correctly.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to S1AP interface (port 36412) to trusted eNodeBs only using firewall rules.
iptables -A INPUT -p sctp --dport 36412 -s trusted_eNodeB_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1AP interface exposure
- Deploy monitoring and automated restart mechanisms for MME service
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-mmed --version. If version <= 2.6.4 and S1AP interface is exposed, system is vulnerable.Check Version:
open5gs-mmed --versionVerify Fix Applied:
Verify version is >= 2.6.5 and test with legitimate S1AP traffic to ensure MME remains stable.📡 Detection & Monitoring
Log Indicators:
- MME assertion failures
- MME service crashes
- S1AP connection resets from unexpected sources
Network Indicators:
- Malformed S1AP packets
- E-RAB Modification Indication messages missing MME_UE_S1AP_ID field
SIEM Query:
source="open5gs-mme.log" AND ("assertion" OR "crash" OR "abort")