CVE-2023-37014
📋 TL;DR
CVE-2023-37014 is a denial-of-service vulnerability in Open5GS MME where attackers can send malformed S1AP packets to crash the service. This affects cellular network operators using Open5GS MME versions 2.6.4 and earlier. The vulnerability allows remote attackers to disrupt mobile network connectivity.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Sustained MME crashes causing complete denial of mobile network services in affected cells, disrupting voice, data, and SMS services for all users.
Likely Case
Intermittent service disruptions as MME restarts, causing dropped calls, failed connections, and degraded network performance.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and response to attack attempts.
🎯 Exploit Status
Exploitation requires understanding of S1AP protocol and ability to send crafted packets to MME interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5 or later
Vendor Advisory: https://github.com/open5gs/open5gs/security/advisories
Restart Required: Yes
Instructions:
1. Update Open5GS to version 2.6.5 or later. 2. Restart MME service. 3. Verify service is running correctly.
🔧 Temporary Workarounds
Network Segmentation
LinuxRestrict access to S1AP interface (port 36412) to trusted eNodeBs only using firewall rules.
iptables -A INPUT -p sctp --dport 36412 -s trusted_enodeb_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1AP interface exposure.
- Deploy intrusion detection systems monitoring for malformed S1AP packets and implement rate limiting.
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-mmed --version. If version <= 2.6.4, system is vulnerable.Check Version:
open5gs-mmed --versionVerify Fix Applied:
After patching, verify version is >= 2.6.5 and test with legitimate S1AP traffic.📡 Detection & Monitoring
Log Indicators:
- MME process crashes/restarts in system logs
- ASN.1 parsing errors in Open5GS logs
- Abnormal UE Context Release Request patterns
Network Indicators:
- Malformed S1AP packets missing MME_UE_S1AP_ID field
- High volume of UE Context Release Requests from single source
SIEM Query:
source="open5gs.log" AND ("assertion" OR "crash" OR "S1AP" AND "malformed")