CVE-2023-37017
📋 TL;DR
Open5GS MME versions up to 2.6.4 contain a remotely triggerable assertion via malformed ASN.1 packets on the S1AP interface. Attackers can send S1Setup Request messages missing the Global eNB ID field to repeatedly crash the MME, causing denial of service. This affects cellular network operators using vulnerable Open5GS deployments.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Sustained MME crashes leading to complete cellular service disruption in affected areas, preventing voice calls, SMS, and data services for subscribers.
Likely Case
Intermittent service outages and degraded network performance as MME restarts repeatedly under attack.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and response.
🎯 Exploit Status
Requires knowledge of S1AP protocol and ability to send malformed packets to MME interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5
Vendor Advisory: https://github.com/open5gs/open5gs/releases/tag/v2.6.5
Restart Required: No
Instructions:
1. Download Open5GS version 2.6.5 or later from GitHub. 2. Replace vulnerable MME component. 3. Verify S1AP interface functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict S1AP interface access to trusted eNBs only using firewall rules.
iptables -A INPUT -p sctp --dport 36412 -s trusted_eNB_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1AP interface exposure.
- Deploy intrusion detection systems monitoring for malformed S1AP packets.
🔍 How to Verify
Check if Vulnerable:
Check Open5GS MME version: open5gs-mmed --versionCheck Version:
open5gs-mmed --versionVerify Fix Applied:
Verify version is 2.6.5 or higher and monitor for assertion failures in logs.📡 Detection & Monitoring
Log Indicators:
- MME assertion failures
- S1AP protocol parsing errors
- MME process restarts
Network Indicators:
- Unusual S1Setup Request patterns
- S1AP packets missing required fields
SIEM Query:
source="open5gs.log" AND ("assertion" OR "S1AP" OR "Global eNB ID")