CVE-2023-37008
📋 TL;DR
CVE-2023-37008 is a buffer overflow vulnerability in Open5GS MME's ASN.1 deserialization function that can cause type confusion during S1AP message processing. This allows attackers to crash the MME service or potentially execute arbitrary code in certain conditions. Affected systems are those running Open5GS MME versions 2.6.4 and earlier.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete compromise of the MME, potentially allowing attacker to intercept/modify cellular network traffic or pivot to other network elements.
Likely Case
Denial of service through MME crash, disrupting cellular network connectivity for affected users.
If Mitigated
Service disruption limited to MME restart if proper segmentation and monitoring are in place.
🎯 Exploit Status
Exploitation requires sending specially crafted S1AP messages to the MME, which requires network access to the S1 interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5
Vendor Advisory: https://github.com/open5gs/open5gs/security/advisories/GHSA-xxxx-xxxx-xxxx
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Open5GS MME service. 3. Update to Open5GS version 2.6.5 or later. 4. Restart MME service. 5. Verify service is running correctly.
🔧 Temporary Workarounds
Network segmentation
linuxRestrict S1 interface access to trusted eNodeBs only using firewall rules.
iptables -A INPUT -p sctp --dport 36412 -s trusted_eNodeB_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to limit S1 interface access to authorized eNodeBs only.
- Deploy intrusion detection systems monitoring for anomalous S1AP message patterns and implement automated MME restart on crash detection.
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-mmed --version. If version is 2.6.4 or earlier, system is vulnerable.Check Version:
open5gs-mmed --versionVerify Fix Applied:
After patching, verify version is 2.6.5 or later and test S1AP message processing with normal eNodeB connections.📡 Detection & Monitoring
Log Indicators:
- MME crash logs
- ASN.1 parsing errors in Open5GS logs
- Unexpected memory allocation failures
Network Indicators:
- Malformed S1AP messages
- Unusual SCTP packet patterns to port 36412
SIEM Query:
source="open5gs.log" AND ("segmentation fault" OR "buffer overflow" OR "ASN.1 error")