CVE-2023-37016
Published: 22 January 2025
Description
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Modification Response` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
Security Summary
CVE-2023-37016 affects Open5GS Mobility Management Entity (MME) versions up to and including 2.6.4. The vulnerability stems from an assertion failure triggered by a malformed ASN.1 packet over the S1AP interface. Specifically, an attacker can send a UE Context Modification Response message lacking the required MME_UE_S1AP_ID field, causing the MME process to crash. This issue is classified under CWE-617 (Reachable Assertion) and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity due to its network accessibility, low complexity, and scope change.
Any unauthenticated remote attacker with network access to the S1AP interface can exploit this vulnerability. By repeatedly transmitting the malformed UE Context Modification Response, the attacker can crash the MME process multiple times, leading to a denial-of-service condition that disrupts core network functions for user equipment context management.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked.
Details
- CWE(s)