CVE-2023-37032
Published: 21 January 2025
Summary
CVE-2023-37032 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Linuxfoundation Magma. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2023-37032 is a stack-based buffer overflow vulnerability in the Mobile Management Entity (MME) component of Magma versions up to and including 1.8.0. The flaw arises when processing a Non-Access Stratum (NAS) packet containing an oversized Emergency Number List Information Element, leading to a buffer overflow. It is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-787 (Out-of-bounds Write) and CWE-78.
Remote attackers can exploit this vulnerability without authentication by using a cellphone to send a specially crafted NAS packet to the MME. Successful exploitation results in a denial-of-service condition, crashing the MME and disrupting mobile network services.
The vulnerability is fixed in Magma version 1.9 at commit 08472ba98b8321f802e95f5622fa90fec2dea486. Additional details are available in the advisory at https://cellularsecurity.org/ransacked.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-40952
Vulnerability details
A Stack-based buffer overflow in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows remote attackers to crash the MME with an unauthenticated cellphone by sending a NAS packet containing an oversized `Emergency…
more
Number List` Information Element.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing MME via crafted packet enables initial access (T1190); buffer overflow directly causes application DoS via exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of NAS packet inputs, including length checks on Information Elements like the Emergency Number List, directly preventing the oversized input buffer overflow.
SI-16 enforces memory protections such as stack canaries and non-executable stacks to mitigate exploitation of stack-based buffer overflows in the MME.
SI-2 requires timely flaw remediation, including patching Magma to version 1.9, to eliminate the specific buffer overflow vulnerability.