CVE-2023-37018
📋 TL;DR
Open5GS MME versions up to 2.6.4 contain a remotely triggerable assertion vulnerability via malformed ASN.1 packets on the S1AP interface. Attackers can send UE Capability Info Indication messages missing the MME_UE_S1AP_ID field to repeatedly crash the MME service, causing denial of service. This affects all deployments using vulnerable Open5GS MME software.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Sustained denial of service affecting all mobile network users in the coverage area, potentially disrupting emergency services and critical communications.
Likely Case
Intermittent service disruptions affecting subsets of users, requiring manual MME restarts and causing service degradation.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and response to attack attempts.
🎯 Exploit Status
Exploitation requires knowledge of S1AP protocol and ability to send crafted packets to the MME interface. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5 and later
Vendor Advisory: https://github.com/open5gs/open5gs/releases
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Open5GS to version 2.6.5 or later using package manager or source compilation. 3. Restart MME service. 4. Verify service is running correctly.
🔧 Temporary Workarounds
Network Access Control
LinuxRestrict access to S1AP interface (default port 36412) to trusted eNodeBs only using firewall rules.
iptables -A INPUT -p sctp --dport 36412 -s trusted_enodeb_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MME from untrusted networks.
- Deploy intrusion detection systems monitoring for malformed S1AP packets and implement automated alerting.
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-mmed --version. If version is 2.6.4 or earlier, system is vulnerable.Check Version:
open5gs-mmed --versionVerify Fix Applied:
After patching, verify version is 2.6.5 or later and monitor MME logs for stability during normal operation.📡 Detection & Monitoring
Log Indicators:
- MME process crashes/restarts in system logs
- ASN.1 decoding errors in Open5GS logs
- Abnormal UE Capability Info Indication messages
Network Indicators:
- Unusual S1AP traffic from unexpected sources
- High volume of UE Capability Info Indication messages
- Missing MME_UE_S1AP_ID fields in packet captures
SIEM Query:
source="open5gs.log" AND ("assertion" OR "crash" OR "ASN.1 error")