CVE-2023-37020
Published: 22 January 2025
Description
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Release Complete` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
Security Summary
CVE-2023-37020 affects Open5GS Mobility Management Entity (MME) versions up to and including 2.6.4. The vulnerability stems from an assertion failure that can be triggered remotely via a malformed ASN.1 packet over the S1AP interface. Specifically, an attacker can send a UE Context Release Complete message lacking the required MME_UE_S1AP_ID field, causing the MME to crash. This issue is classified under CWE-617 (Reachable Assertion) and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity due to its network accessibility, low complexity, and scope change with high availability impact.
Any unauthenticated remote attacker with network access to the S1AP interface can exploit this vulnerability. By repeatedly transmitting the malformed UE Context Release Complete message, the attacker can crash the MME process, leading to a denial-of-service condition that disrupts core network functions for user equipment context management.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked.
Details
- CWE(s)