CVE-2023-37037
📋 TL;DR
This vulnerability allows network-adjacent attackers to crash the Mobile Management Entity (MME) in Magma cellular core networks by sending a malformed S1AP S1Setup Request packet missing the Supported TAs field. The null pointer dereference causes a denial of service, affecting organizations running vulnerable Magma versions in their cellular infrastructure.
💻 Affected Systems
- Magma (Open-source mobile core network platform)
📦 What is this software?
Magma by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete MME service outage disrupting cellular connectivity for all users served by that MME, potentially affecting emergency services and critical communications.
Likely Case
Service disruption requiring manual restart of the MME component, causing temporary cellular service outages.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploitation requires crafting a specific malformed S1AP packet but is straightforward for attackers with network access to the MME interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.0 (specifically commit 08472ba98b8321f802e95f5622fa90fec2dea486)
Vendor Advisory: https://cellularsecurity.org/ransacked
Restart Required: Yes
Instructions:
1. Update Magma to version 1.9.0 or later. 2. Apply commit 08472ba98b8321f802e95f5622fa90fec2dea486 if using custom builds. 3. Restart the MME service after patching.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to the MME S1 interface to trusted network segments only
iptables -A INPUT -p sctp --dport 36412 -s trusted_network -j ACCEPT
iptables -A INPUT -p sctp --dport 36412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit S1 interface exposure to trusted eNodeBs only
- Deploy monitoring and alerting for MME crashes with automated restart capabilities
🔍 How to Verify
Check if Vulnerable:
Check Magma version: magma version | grep -i version. If version <= 1.8.0, system is vulnerable.Check Version:
magma versionVerify Fix Applied:
Verify version is >= 1.9.0 and check that commit 08472ba98b8321f802e95f5622fa90fec2dea486 is present in the codebase.📡 Detection & Monitoring
Log Indicators:
- MME crash logs
- S1AP protocol errors
- Null pointer exception in MME logs
Network Indicators:
- Malformed S1AP S1Setup Request packets missing Supported TAs field
- Unusual SCTP traffic to MME port 36412
SIEM Query:
source="magma_logs" AND ("null pointer" OR "segmentation fault" OR "S1AP error")