CVE-2023-37012
📋 TL;DR
Open5GS MME versions up to 2.6.4 contain a remotely triggerable assertion via malformed ASN.1 packets on the S1AP interface. Attackers can send Initial UE Message packets missing the PLMN Identity field to repeatedly crash the MME service, causing denial of service. This affects all deployments using vulnerable Open5GS MME versions.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Sustained MME crashes leading to complete cellular network service disruption for affected area, preventing mobile device connectivity.
Likely Case
Intermittent MME service crashes causing temporary connectivity issues for mobile users until service restarts.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and response.
🎯 Exploit Status
Exploitation requires sending specially crafted S1AP packets but does not require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5 and later
Vendor Advisory: https://github.com/open5gs/open5gs/security/advisories
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Open5GS to version 2.6.5 or later. 3. Restart MME service. 4. Verify service is running correctly.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict S1AP interface access to trusted eNodeBs only using firewall rules.
iptables -A INPUT -p sctp --dport 36412 -s trusted_enodeb_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1AP interface exposure
- Deploy intrusion detection systems monitoring for malformed S1AP packets
🔍 How to Verify
Check if Vulnerable:
Check Open5GS MME version: open5gs-mmed --versionCheck Version:
open5gs-mmed --version | grep -o 'version [0-9.]*'Verify Fix Applied:
Verify version is 2.6.5 or later and monitor for MME crashes after patch.📡 Detection & Monitoring
Log Indicators:
- MME process crashes in system logs
- Repeated MME service restarts
- Assertion failure messages in Open5GS logs
Network Indicators:
- Unusual S1AP packets missing PLMN Identity field
- S1AP packets from untrusted sources
SIEM Query:
source="open5gs.logs" AND ("assertion" OR "crash" OR "abort") AND process="mmed"