CVE-2023-37029
📋 TL;DR
CVE-2023-37029 allows attackers to cause denial of service by sending oversized NAS packets to Magma MME, crashing it via assertion failure. This affects Magma cellular core network deployments running versions 1.8.0 or earlier. Attackers can exploit this from compromised base stations or unauthenticated devices within range.
💻 Affected Systems
- Magma MME (Mobility Management Entity)
📦 What is this software?
Magma by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Sustained MME crashes causing complete cellular service disruption for affected base stations, potentially affecting thousands of users.
Likely Case
Intermittent service outages as attackers periodically crash MME, degrading cellular network reliability.
If Mitigated
Minimal impact with proper network segmentation and monitoring to detect and block malicious traffic.
🎯 Exploit Status
Requires ability to send NAS packets to MME via cellular interface, either from compromised base station or spoofed device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9 (specifically commit 08472ba98b8321f802e95f5622fa90fec2dea486)
Vendor Advisory: https://cellularsecurity.org/ransacked
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Magma to version 1.9 or later. 3. Restart MME service. 4. Verify service functionality.
🔧 Temporary Workarounds
Network Traffic Filtering
linuxImplement packet filtering to block oversized NAS packets at network perimeter
# Example iptables rule (adjust interface/ports):
iptables -A INPUT -p sctp --dport 36412 -m length --length 2000:65535 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MME from untrusted base stations
- Deploy intrusion detection systems to monitor for abnormal NAS packet sizes and block malicious sources
🔍 How to Verify
Check if Vulnerable:
Check Magma version: magma version | grep -i versionCheck Version:
magma versionVerify Fix Applied:
Verify version is >=1.9 and check MME logs for successful startup without assertion failures📡 Detection & Monitoring
Log Indicators:
- MME assertion failures
- Process crashes with NAS packet handling errors
- Repeated MME service restarts
Network Indicators:
- Unusually large NAS packets (> typical MTU)
- SCTP packets with abnormal payload sizes to port 36412
SIEM Query:
source="magma_mme.log" AND ("assertion" OR "crash" OR "abort") AND "NAS"