CVE-2023-37021
📋 TL;DR
Open5GS MME versions up to 2.6.4 contain a remotely triggerable assertion via malformed S1AP packets. Attackers can send UE Context Modification Failure messages missing the MME_UE_S1AP_ID field to repeatedly crash the MME service, causing denial of service. This affects cellular network operators using vulnerable Open5GS deployments.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Sustained MME crashes leading to complete cellular service disruption in affected areas, preventing mobile device connectivity and calls.
Likely Case
Intermittent MME service crashes causing temporary connectivity issues for mobile users, requiring manual service restarts.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and response to attack attempts.
🎯 Exploit Status
Requires knowledge of S1AP protocol and ability to craft malformed packets, but no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5
Vendor Advisory: https://github.com/open5gs/open5gs/releases/tag/v2.6.5
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Open5GS to version 2.6.5 or later. 3. Restart MME service. 4. Verify service is running correctly.
🔧 Temporary Workarounds
Network Segmentation
LinuxRestrict S1AP interface access to trusted eNodeBs only using firewall rules.
iptables -A INPUT -p sctp --dport 36412 -s trusted_enodeb_ip -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1AP interface exposure.
- Deploy intrusion detection systems monitoring for malformed S1AP packets.
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: if <= 2.6.4 and MME service is running, system is vulnerable.Check Version:
open5gs-mmed --versionVerify Fix Applied:
After patching, verify version is >= 2.6.5 and test with legitimate S1AP traffic.📡 Detection & Monitoring
Log Indicators:
- MME service crash logs
- Assertion failure messages in system logs
- Repeated MME restarts
Network Indicators:
- Unusual S1AP traffic patterns
- UE Context Modification Failure messages missing MME_UE_S1AP_ID field
SIEM Query:
source="open5gs.logs" AND ("assertion" OR "crash" OR "abort") AND process="mme"