CVE-2023-37032
📋 TL;DR
A stack-based buffer overflow vulnerability in Magma's Mobile Management Entity (MME) allows remote attackers to crash the service by sending specially crafted NAS packets with oversized Emergency Number List elements. This affects Magma versions 1.8.0 and earlier, potentially disrupting cellular network services for affected deployments.
💻 Affected Systems
- Magma Core
📦 What is this software?
Magma by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for cellular network subscribers in affected areas, potentially leading to service disruption and emergency call failures.
Likely Case
MME service crash requiring restart, causing temporary service interruption for mobile users.
If Mitigated
Service remains stable with proper network segmentation and monitoring in place.
🎯 Exploit Status
Exploitation requires sending malformed NAS packets to the MME interface, which typically requires network access to the cellular core.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9 (commit 08472ba98b8321f802e95f5622fa90fec2dea486)
Vendor Advisory: https://cellularsecurity.org/ransacked
Restart Required: Yes
Instructions:
1. Update Magma to version 1.9 or later. 2. Apply commit 08472ba98b8321f802e95f5622fa90fec2dea486 if using custom build. 3. Restart MME service.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to MME interfaces to trusted network segments only
Rate Limiting
allImplement rate limiting on NAS packet processing to limit impact
🧯 If You Can't Patch
- Implement strict network access controls to MME interfaces
- Deploy intrusion detection systems to monitor for malformed NAS packets
🔍 How to Verify
Check if Vulnerable:
Check Magma version: if <= 1.8.0, system is vulnerableCheck Version:
magma versionVerify Fix Applied:
Verify version is >= 1.9 or contains commit 08472ba98b8321f802e95f5622fa90fec2dea486📡 Detection & Monitoring
Log Indicators:
- MME service crashes
- Segmentation fault errors in MME logs
- Abnormal NAS packet processing errors
Network Indicators:
- Unusually large NAS packets
- Multiple connection attempts with malformed Emergency Number List elements
SIEM Query:
source="magma_mme.log" AND ("segmentation fault" OR "buffer overflow" OR "emergency number list")