CVE-2023-37016
Published: 22 January 2025
Summary
CVE-2023-37016 is a high-severity Reachable Assertion (CWE-617) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 46.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the software flaw causing assertion failure in Open5GS MME from malformed S1AP packets by monitoring vulnerabilities and applying patches.
Protects against denial-of-service by limiting effects of repeated MME crashes triggered by malformed UE Context Modification Response packets.
Validates content of incoming S1AP ASN.1 packets to reject malformed messages missing required fields like MME_UE_S1AP_ID.
NVD Description
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Modification Response` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash…
more
the MME, resulting in denial of service.
Deeper analysisAI
CVE-2023-37016 affects Open5GS Mobility Management Entity (MME) versions up to and including 2.6.4. The vulnerability stems from an assertion failure triggered by a malformed ASN.1 packet over the S1AP interface. Specifically, an attacker can send a UE Context Modification Response message lacking the required MME_UE_S1AP_ID field, causing the MME process to crash. This issue is classified under CWE-617 (Reachable Assertion) and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity due to its network accessibility, low complexity, and scope change.
Any unauthenticated remote attacker with network access to the S1AP interface can exploit this vulnerability. By repeatedly transmitting the malformed UE Context Modification Response, the attacker can crash the MME process multiple times, leading to a denial-of-service condition that disrupts core network functions for user equipment context management.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked.
Details
- CWE(s)