CVE-2023-37022
Published: 22 January 2025
Description
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID` field causes Open5gs to crash; an attacker may repeatedly send such packets to cause denial of service.
Security Summary
CVE-2023-37022 is a vulnerability in Open5GS MME versions up to and including 2.6.4, stemming from a reachable assertion in the UE Context Release Request packet handler. An invalid MME_UE_S1AP_ID field in a received packet triggers the assertion, causing the Open5GS MME to crash. This issue is associated with CWE-400 (Uncontrolled Resource Consumption) and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
The vulnerability can be exploited by any unauthenticated attacker with network access to the Open5GS MME. By sending crafted UE Context Release Request packets containing an invalid MME_UE_S1AP_ID, the attacker causes an immediate crash. Repeatedly sending such packets enables sustained denial of service, disrupting MME availability without requiring privileges or user interaction.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked.
Details
- CWE(s)