CVE-2023-37022
Published: 22 January 2025
Summary
CVE-2023-37022 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 45.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2023-37022 is a vulnerability in Open5GS MME versions up to and including 2.6.4, stemming from a reachable assertion in the UE Context Release Request packet handler. An invalid MME_UE_S1AP_ID field in a received packet triggers the assertion, causing the Open5GS MME to crash. This issue is associated with CWE-400 (Uncontrolled Resource Consumption) and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
The vulnerability can be exploited by any unauthenticated attacker with network access to the Open5GS MME. By sending crafted UE Context Release Request packets containing an invalid MME_UE_S1AP_ID, the attacker causes an immediate crash. Repeatedly sending such packets enables sustained denial of service, disrupting MME availability without requiring privileges or user interaction.
Mitigation details are available in the advisory published at https://cellularsecurity.org/ransacked.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-40942
Vulnerability details
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID` field causes Open5gs to crash; an attacker may repeatedly send such packets to cause denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables application-layer DoS via crafted packet exploitation of a reachable assertion in the MME service handler.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates the MME_UE_S1AP_ID field in UE Context Release Request packets to reject invalid values before triggering the assertion failure.
Ensures the packet handler gracefully manages invalid MME_UE_S1AP_ID errors without crashing the Open5GS MME process.
Protects the MME from denial-of-service by mitigating repeated crafted packets that exploit the assertion vulnerability.