CVE-2023-37025
📋 TL;DR
A null pointer dereference vulnerability in Magma's Mobile Management Entity (MME) allows network-adjacent attackers to crash the MME service by sending a malformed S1AP Reset packet missing the ResetType field. This affects Magma versions up to 1.8.0, potentially disrupting cellular network connectivity for users served by the affected MME.
💻 Affected Systems
- Magma (Open-source mobile core network solution)
📦 What is this software?
Magma by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete MME service crash leading to denial of service for all users in the affected cellular network area, requiring manual restart of the MME service.
Likely Case
Service disruption affecting a subset of users as the MME crashes and potentially restarts automatically, causing temporary connectivity loss.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery from crashes.
🎯 Exploit Status
Exploitation requires sending a specifically crafted S1AP Reset packet, which is relatively simple for attackers with network access to the MME.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.9 (specifically commit 08472ba98b8321f802e95f5622fa90fec2dea486)
Vendor Advisory: https://cellularsecurity.org/ransacked
Restart Required: Yes
Instructions:
1. Update Magma to version 1.9 or later. 2. Apply commit 08472ba98b8321f802e95f5622fa90fec2dea486 if using source build. 3. Restart the MME service after patching.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to MME S1AP interface to only trusted network elements
iptables -A INPUT -p sctp --dport 36412 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1AP interface exposure
- Deploy monitoring and alerting for MME service crashes with automated restart capabilities
🔍 How to Verify
Check if Vulnerable:
Check Magma version: if <= 1.8.0 and MME is running, system is vulnerableCheck Version:
magma version | grep -i versionVerify Fix Applied:
Verify Magma version is >= 1.9 or includes commit 08472ba98b8321f802e95f5622fa90fec2dea486📡 Detection & Monitoring
Log Indicators:
- MME service crash logs
- Segmentation fault errors in MME logs
- Unexpected MME restarts
Network Indicators:
- Malformed S1AP Reset packets missing ResetType field
- Unusual S1AP traffic from unexpected sources
SIEM Query:
source="magma_logs" AND ("segmentation fault" OR "null pointer" OR "MME crash")