CVE-2023-37023
📋 TL;DR
CVE-2023-37023 is a denial-of-service vulnerability in Open5GS MME where specially crafted Uplink NAS Transport packets without the MME_UE_S1AP_ID field cause the service to crash via a reachable assertion. This affects cellular network operators and organizations using Open5GS for 4G/5G core network testing or deployment. Attackers can repeatedly send malicious packets to disrupt mobile network connectivity.
💻 Affected Systems
- Open5GS MME
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of mobile network services in affected cells, preventing voice, data, and SMS services for all users in the impacted area until service restoration.
Likely Case
Intermittent service outages affecting mobile users, potentially causing dropped calls, failed data sessions, and degraded network performance.
If Mitigated
Limited impact with proper network segmentation and monitoring, allowing quick detection and isolation of attack traffic.
🎯 Exploit Status
Exploitation requires network access to the MME interface and knowledge of NAS protocol. No authentication bypass is needed once network access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5 and later
Vendor Advisory: https://github.com/open5gs/open5gs/releases
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Open5GS services. 3. Update to Open5GS version 2.6.5 or later. 4. Restart Open5GS services. 5. Verify service functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to MME interfaces to only authorized network elements using firewall rules.
Rate Limiting
linuxImplement rate limiting on SCTP port 36412 to limit impact of DoS attempts.
iptables -A INPUT -p sctp --dport 36412 -m limit --limit 100/minute -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to MME interfaces
- Deploy intrusion detection systems to monitor for malicious NAS packets
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-mmed --version. If version <= 2.6.4, system is vulnerable.Check Version:
open5gs-mmed --versionVerify Fix Applied:
Verify version is >= 2.6.5 and monitor system logs for crashes after applying patch.📡 Detection & Monitoring
Log Indicators:
- MME process crashes
- Assertion failures in logs
- Unexpected service restarts
- Error messages about missing MME_UE_S1AP_ID
Network Indicators:
- Unusual volume of Uplink NAS Transport packets
- Packets missing expected fields
- SCTP traffic spikes to port 36412
SIEM Query:
source="open5gs.log" AND ("assertion" OR "crash" OR "MME_UE_S1AP_ID missing")