Cyber Posture

CVE-2023-37032

HighPublic PoC

Published: 21 January 2025

Published
21 January 2025
Modified
13 March 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0079 74.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

A Stack-based buffer overflow in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows remote attackers to crash the MME with an unauthenticated cellphone by sending a NAS packet containing an oversized `Emergency Number List` Information Element.

Security Summary

CVE-2023-37032 is a stack-based buffer overflow vulnerability in the Mobile Management Entity (MME) component of Magma versions up to and including 1.8.0. The flaw arises when processing a Non-Access Stratum (NAS) packet containing an oversized Emergency Number List Information Element, leading to a buffer overflow. It is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-787 (Out-of-bounds Write) and CWE-78.

Remote attackers can exploit this vulnerability without authentication by using a cellphone to send a specially crafted NAS packet to the MME. Successful exploitation results in a denial-of-service condition, crashing the MME and disrupting mobile network services.

The vulnerability is fixed in Magma version 1.9 at commit 08472ba98b8321f802e95f5622fa90fec2dea486. Additional details are available in the advisory at https://cellularsecurity.org/ransacked.

Details

CWE(s)
CWE-787CWE-78

Affected Products

linuxfoundation
magma
≤ 1.8.0

References