CVE-2023-37019
📋 TL;DR
This vulnerability allows remote attackers to cause denial of service by sending specially crafted S1AP packets to Open5GS MME servers. Attackers can repeatedly crash the MME service by triggering an assertion failure via malformed ASN.1 packets. This affects all deployments running vulnerable Open5GS MME versions.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Sustained MME crashes leading to complete cellular network service disruption in the affected area, preventing mobile devices from connecting to the network.
Likely Case
Intermittent MME service disruptions causing dropped connections and failed network attach procedures for mobile devices.
If Mitigated
Limited impact with proper network segmentation and monitoring, allowing quick detection and recovery from crashes.
🎯 Exploit Status
Exploitation requires knowledge of S1AP protocol and ability to craft malformed ASN.1 packets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5 or later
Vendor Advisory: https://github.com/open5gs/open5gs/releases
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Open5GS to version 2.6.5 or later. 3. Restart MME service. 4. Verify service is running correctly.
🔧 Temporary Workarounds
Network Segmentation
LinuxRestrict access to S1AP interface (port 36412) to trusted eNodeBs only using firewall rules.
iptables -A INPUT -p sctp --dport 36412 -s trusted_enodeb_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1AP interface exposure.
- Deploy intrusion detection systems to monitor for malformed S1AP packets.
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-mmed --version. If version <= 2.6.4, system is vulnerable.Check Version:
open5gs-mmed --versionVerify Fix Applied:
Verify version is >= 2.6.5 and monitor MME logs for stability after applying patch.📡 Detection & Monitoring
Log Indicators:
- MME process crashes
- Assertion failures in logs
- Repeated S1Setup Request failures
Network Indicators:
- Unusual S1AP traffic patterns
- S1Setup Request messages missing Supported TAs field
SIEM Query:
source="open5gs.log" AND ("assertion" OR "crash" OR "S1Setup")