CVE-2023-37004
📋 TL;DR
This vulnerability allows remote attackers to cause denial of service in Open5GS MME by sending specially crafted ASN.1 packets over the S1AP interface. The missing MME_UE_S1AP_ID field in Initial Context Setup Response messages triggers an assertion failure, repeatedly crashing the MME service. This affects all deployments running vulnerable Open5GS MME versions.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Sustained MME crashes leading to complete cellular network service disruption for affected area, preventing mobile device connectivity and emergency services access.
Likely Case
Intermittent MME service outages causing dropped calls, failed connections, and degraded network performance until service is manually restarted.
If Mitigated
Limited service disruption with automatic failover to redundant MME instances and rapid detection/response to attack patterns.
🎯 Exploit Status
Exploitation requires network access to S1AP interface but no authentication. The attack is simple to implement once the malformed packet structure is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5 and later
Vendor Advisory: https://github.com/open5gs/open5gs/releases
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Open5GS services. 3. Update to Open5GS version 2.6.5 or later. 4. Restart Open5GS services. 5. Verify service functionality.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to S1AP interface (default port 36412) to trusted eNodeBs only using firewall rules.
iptables -A INPUT -p sctp --dport 36412 -s trusted_enodeb_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1AP interface exposure
- Deploy redundant MME instances with load balancing and automatic failover
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-mmed --version. If version <= 2.6.4, system is vulnerable.Check Version:
open5gs-mmed --versionVerify Fix Applied:
After patching, verify version is >= 2.6.5 and monitor MME logs for stability during normal operation.📡 Detection & Monitoring
Log Indicators:
- MME crash logs with assertion failures
- Repeated MME service restarts
- Error messages mentioning ASN.1 parsing or S1AP protocol violations
Network Indicators:
- Unusual S1AP traffic patterns
- Initial Context Setup Response messages from untrusted sources
- High volume of S1AP messages to MME
SIEM Query:
source="open5gs-mme.log" AND ("assertion" OR "crash" OR "S1AP" AND "malformed")