CVE-2023-37027
📋 TL;DR
A null pointer dereference vulnerability in Magma's Mobile Management Entity (MME) allows network-adjacent attackers to crash the MME service by sending a malformed S1AP packet. This affects Magma versions up to 1.8.0, potentially disrupting cellular network connectivity for users served by vulnerable MME instances.
💻 Affected Systems
- Magma
📦 What is this software?
Magma by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete MME service crash leading to denial of service for all users in affected cellular network area, requiring manual restart of the MME service.
Likely Case
Service disruption affecting cellular connectivity in the impacted network segment until MME is restarted.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploitation requires sending a specifically crafted S1AP packet to the MME interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9 (commit 08472ba98b8321f802e95f5622fa90fec2dea486)
Vendor Advisory: https://cellularsecurity.org/ransacked
Restart Required: Yes
Instructions:
1. Update Magma to version 1.9 or later. 2. Restart the MME service. 3. Verify the fix by checking the version and monitoring for crashes.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to S1AP interface to trusted network segments only
iptables -A INPUT -p sctp --dport 36412 -s trusted_network -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1AP interface exposure
- Deploy monitoring and alerting for MME service crashes with automated restart capabilities
🔍 How to Verify
Check if Vulnerable:
Check Magma version: if <= 1.8.0 and MME service is running, system is vulnerableCheck Version:
magma version | grep -i versionVerify Fix Applied:
Verify Magma version is >= 1.9 and monitor MME service for stability📡 Detection & Monitoring
Log Indicators:
- MME service crash logs
- Segmentation fault errors in MME logs
- Unexpected service restarts
Network Indicators:
- Malformed S1AP packets with missing eNB_UE_S1AP_ID field
- Unusual S1AP traffic patterns
SIEM Query:
source="magma_mme.log" AND ("segmentation fault" OR "null pointer" OR "crash")