CVE-2023-37014
Published: 22 January 2025
Description
Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Release Request` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
Security Summary
CVE-2023-37014 affects Open5GS Mobility Management Entity (MME) versions up to and including 2.6.4. The vulnerability stems from an assertion failure that can be remotely triggered by a malformed ASN.1 packet over the S1AP interface. Specifically, an attacker can send a UE Context Release Request message lacking the required MME_UE_S1AP_ID field, causing the MME process to crash.
Any remote unauthenticated attacker with network access to the S1AP interface can exploit this vulnerability. By repeatedly sending the malformed packet, the attacker can cause repeated crashes of the MME, resulting in a denial-of-service condition that disrupts core network services for user equipment context management. The CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects its high availability impact with low complexity and no privileges required.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked.
Details
- CWE(s)