CVE-2023-37020
📋 TL;DR
Open5GS MME versions up to 2.6.4 contain a remotely triggerable assertion via malformed ASN.1 packets on the S1AP interface. Attackers can send UE Context Release Complete messages missing the required MME_UE_S1AP_ID field to repeatedly crash the MME, causing denial of service. This affects cellular network operators using vulnerable Open5GS deployments.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Sustained MME crashes leading to complete cellular service disruption in affected areas, preventing voice/data connectivity for subscribers.
Likely Case
Intermittent MME crashes causing service degradation, dropped calls, and failed network connections until manual restart.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and response to attack attempts.
🎯 Exploit Status
Requires knowledge of S1AP protocol and ability to send crafted packets to MME interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5 or later
Vendor Advisory: https://github.com/open5gs/open5gs/releases
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Open5GS to version 2.6.5 or later. 3. Restart MME service. 4. Verify service functionality.
🔧 Temporary Workarounds
Network Segmentation
LinuxRestrict S1AP interface access to trusted eNodeBs only using firewall rules.
iptables -A INPUT -p sctp --dport 36412 -s trusted_eNodeB_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1AP interface exposure.
- Deploy intrusion detection systems monitoring for malformed S1AP packets.
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-mmed --versionCheck Version:
open5gs-mmed --version | grep -o 'version [0-9.]*'Verify Fix Applied:
Confirm version is 2.6.5 or later and monitor for assertion crashes in logs.📡 Detection & Monitoring
Log Indicators:
- MME assertion failures
- Process crashes with ASN.1 parsing errors
- Repeated MME service restarts
Network Indicators:
- Unusual S1AP traffic patterns
- UE Context Release Complete messages from unexpected sources
SIEM Query:
source="open5gs.log" AND ("assertion" OR "crash" OR "S1AP")