CVE-2023-37024

Executive Summary

CVE-2023-37024 is a reachable assertion vulnerability in the Mobile Management Entity (MME) of Magma versions <= 1.8.0. A remote, unauthenticated attacker in possession of a cellular device can crash the MME by sending a single NAS (Non-Access Stratum) packet containing an Emergency Number List Information Element. Successful exploitation results in a denial-of-service condition affecting the LTE/5G control plane of any Magma-deployed core network, with the fix landing in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486. No CVSS score, CWE identifier, or vendor-advisory confirmation is currently available in the CVE data; the vulnerability class (reachable assertion, CWE-617) and unauthenticated attack vector make this a high-priority patching item for operators running affected Magma releases.

Technical Analysis

The MME is a central control-plane function in the Evolved Packet Core (EPC) and is also present in the Magma Access Gateway (AGW) architecture. It is responsible for UE attach/detach procedures, authentication, bearer establishment, and mobility tracking. All of these procedures rely on the NAS protocol, which is exchanged between the mobile handset (UE) and the MME, transported transparently by the radio access network (eNodeB/gNodeB). The vulnerability in CVE-2023-37024 exists in the NAS message handling path of the MME in Magma versions <= 1.8.0.

A "reachable assertion" (CWE-617) means that the code contains an invariant check of the form assert(condition), and that this check can be reached and violated using externally supplied input. When the asserted condition evaluates to false, the process terminates abnormally — typically via an abort() call — rather than gracefully rejecting the malformed input. The NVD description identifies the trigger as a NAS packet containing an Emergency Number List Information Element. The Emergency Number List IE is a standard NAS element used to provision emergency call numbers to the UE. In affected Magma versions, the MME's parser for this IE apparently does not handle a specific malformed or unexpected encoding, such that the parser state violates an invariant, firing the assertion and crashing the MME process.

The attack surface is noteworthy for two reasons:

1. Unauthenticated by design: NAS attach and registration procedures are processed by the MME before any subscriber authentication completes. The network cannot distinguish a legitimate UE from a malicious one at this stage, so no credentials or prior registration are required to deliver the malformed packet.
2. Remote via radio or backhaul: The attacker only needs to be an unauthenticated cellphone within range of an eNodeB that is connected to a vulnerable Magma MME. The packet traverses the radio interface and S1AP transport without requiring any network-level authentication.

The exact parsing routine and the specific assertion condition are not disclosed in the NVD description or CNA title, and the patch commit (08472ba98b8321f802e95f5622fa90fec2dea486) is referenced only via OSV without a public diff analysis. Consequently, the precise byte-level malformation that trips the assertion cannot be stated with confidence. What is known from the advisory data is sufficient to characterise the flaw class: an input-dependent crash in a network-facing protocol parser, exploitable with a single unauthenticated packet, resulting in loss of availability of the control plane.

Exploitation Scenarios

Since no public PoC or exploit code is documented for CVE-2023-37024, the attack chain below is inferred strictly from the vulnerability class and the NVD description. It is acceptable and analytically honest to state that the chain is inferred rather than demonstrated.

Step 1 — Reconnaissance / target identification. Magma MMEs are not directly Internet-exposed in a typical deployment; they are reachable via the S1-MME interface over SCTP from eNodeBs. An attacker selects a target operator network that is known or suspected to run Magma (for example, private LTE/5G deployments, rural ISP cores, or testbeds). Identification may be performed by scanning for SCTP services on the MME-facing port, by passive observation of S1AP signalling, or by social/OSINT techniques against a specific operator. From the attacker's perspective, the key requirement is radio access to an eNodeB in the target network, or an S1AP-facing network position.

Step 2 — Flaw trigger. The attacker uses a standard commercial handset with modified firmware, or a software-defined radio, to initiate an attach procedure. The attack does not require valid SIM credentials because the unauthorised packet is processed at a stage before subscriber authentication. The attacker crafts a NAS message — specifically a NAS packet that includes the Emergency Number List Information Element — in a form that the vulnerable MME parser does not expect.

Step 3 — Payload execution / crash. The crafted NAS message is delivered to the MME over the air via the eNodeB, encapsulated per normal S1AP procedures. The MME's NAS parser processes the Emergency Number List IE. Because the vulnerable code path has no defensive error handling for the malformed encoding, the parser reaches an internal invariant check whose condition is false, causing the process to terminate via assertion failure. The impact is a crash of the MME process rather than code execution; the observed effect is an abnormal process exit and a loss of MME availability.

Step 4 — Post-exploitation / impact. With the MME down, the control plane is unavailable: new UE attachments fail, existing sessions cannot be handed over, tracking-area updates time out, and paging is interrupted. For subscribers this manifests as an inability to register or maintain service — effectively a radio-network-wide denial of service. Because the attack requires only a single packet, the attacker can repeat it whenever the MME restarts, turning a transient outage into a persistent availability attack. There is no indication in the CVE data of privilege escalation, data exfiltration, or lateral movement; this is strictly an availability-impacting vulnerability.

Impact Assessment

The business impact of CVE-2023-37024 is entirely within the availability domain. The MME is a control-plane function whose failure degrades or halts service for every subscriber attached to the affected Magma core. For a mobile network operator, a crashed MME means:

• Service interruption: UEs cannot attach or reattach; handovers and tracking area updates fail, causing dropped sessions and "no service" indications on handsets.
• Operational overhead: manual or automated restart of the MME is required; persistent re-triggering forces a loop of crash-restart-crash, requiring operator intervention.
• Brand/revenue impact: SLA breaches, customer complaints, and, in critical-communications or private-network contexts (utilities, public safety, industrial IoT), potentially safety-relevant outages.

The NVD description does not assign a CVSS score or vector ("N/A" in the CVE data), so no CVSS subscore breakdown (AV/AC/PR/UI/S/C/I/A) can be cited. Qualitatively, the attack is network-adjacent or network-reachable, requires no privileges and no user interaction, and has a total availability impact with no direct confidentiality or integrity impact — consistent with a hypothetical vector around AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. The EPSS score of 0.00712 (50.6th percentile of exploited CVEs) indicates that the vulnerability has not been observed being exploited at scale and, as of writing, the CISA KEV catalog has not listed it. The blast radius is contained to a single Magma MME instance per triggered packet, but because each trigger is trivially repeatable, the effective blast radius is the entire coverage area served by that MME and, in multi-Magma deployments, a single site or region rather than the whole core.

Detection Guidance

The following detection content targets observable artefacts of the attack: MME process termination, assertion-failure log entries, and network packets carrying the offending NAS IE. Because the exact binary encoding of the malicious IE is not publicly documented in the CVE data, all network-layer rules are heuristic and should be tuned against your deployment baseline. Log-based rules are the most reliable given that the crash always produces a process-abort and an assertion message in the MME log stream.

Sigma Rule

title: Magma MME Process Crash via Emergency Number List NAS IE
id: 5a0efa5b-8c2a-4a11-a1d3-9b8c7e0f2a11
status: experimental
description: Detects abnormal termination of the Magma MME process associated with an assertion failure, as triggered by CVE-2023-37024.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37024
author: ValtersIT SOC
date: 2025/05/23
logsource:
    product: linux
    service: syslog
detection:
    selection_process:
        process.name: mme
        event.type: "end"
        process.exit_code: 1
    selection_assert:
        - "assert"
        - "ASSERT"
        - "Assertion failed"
        - "Aborted"
    condition: selection_process and selection_assert
falsepositives:
    - Legitimate crashes due to resource exhaustion or operator-initiated restarts with forced abort
level: high

YARA Rule

rule CVE_2023_37024_Magma_MME_NAS_EmergencyNumberList_Assert
{
    meta:
        author = "ValtersIT SOC"
        date = "2025-05-23"
        description = "Detects log files, core dumps, or packet captures containing Magma MME crash artefacts referencing the Emergency Number List NAS IE."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-37024"
    strings:
        $ie = "Emergency Number List" ascii wide
        $assert1 = "assert" ascii wide nocase
        $assert2 = "Assertion failed" ascii wide nocase
        $mme = "MME" ascii wide
    condition:
        $ie and ($assert1 or $assert2) and $mme
}

Note: This YARA rule matches textual artefacts (core dumps, logs, decoded pcap exports) rather than the raw binary NAS encoding, because the specific IE tag byte for the malformed Emergency Number List is not documented in the public CVE data. Treat the rule as a forensic triage aid, not a binary packet exoneration tool.

Suricata IDS Rule

alert sctp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2023-37024 - Magma MME NAS Emergency Number List DoS Attempt (heuristic)"; content:"Emergency Number List"; nocase; classtype:attempted-dos; reference:url,nvd.nist.gov/vuln/detail/CVE-2023-37024; sid:200037024; rev:1;)

Caveat: Suricata's SCTP reassembly support is limited, and the Emergency Number List IE is carried inside the NAS layer which is itself encapsulated in S1AP over SCTP. This rule will primarily fire on intercepted decoded or clear-text NAS samples (e.g., from test harnesses or S1AP-over-IP lab captures). Operators are advised to also enable SCTP decoder logging and to tune the rule against normal signalling traffic to measure the false-positive rate before enabling it in blocking mode.

Elastic Detection

// EQL search across Elasticsearch/Elastic Security events
// Detects MME process termination with a nonzero exit code (abort from assertion failure)
process where event.type == "end"
  and process.name == "mme"
  and process.exit_code != 0

// Complement: search process/log event messages for the assertion text
any where message != null
  and (message like "*assert*" or message like "*Assertion*")
  and message like "*Emergency Number List*"

Aggregate the two queries into a single detection rule where process.name == "mme" and an associated log line contains both the assertion keyword and the IE name. If the MME runs as a container, add event.module == "system" and process.executable path filters based on your Magma deployment layout.

Splunk SPL Query

index=magma sourcetype=mme:log
  ("assert" OR "Assertion" OR "Aborted" OR "terminated")
  AND "Emergency Number List"
| stats count by host, src_ip, _time, process
| sort - _time

For MME process restarts:

index=magma sourcetype=ps sourcetype=process
  process_name=mme status="stopped"
| lookup magma_asset_table host AS host
| where isnull(owner) OR owner="magma-core"
| eval severity=if(match(context, "(?i)assert|abort"), "high", "medium")
| stats values(_time) as crash_times by host, severity
| where mvcount(crash_times) > 3
| alert

The first query detects the crash artefact in MME logs; the second detects abnormally frequent MME process restarts, which is the operational signature of a replayed CVE-2023-37024 attack.

Wazuh OSSEC Rule

<group name="magma,">
    <rule id="180237" level="12">
        <decoded_as>syslog</decoded_as>
        <program_name>mme</program_name>
        <match>Assertion failed|assert</match>
        <description>Magma MME assertion failure - possible CVE-2023-37024 exploitation (NAS Emergency Number List IE)</description>
        <mitre>
            <id>T1499</id>
        </mitre>
        <group>dos,</group>
    </rule>

    <rule id="180238" level="10">
        <decoded_as>syslog</decoded_as>
        <program_name>mme</program_name>
        <match>Emergency Number List</match>
        <description>Detection of NAS Emergency Number List IE reference in MME logs - investigate with rule 180237</description>
    </rule>
</group>

Rule 180237 fires on the assertion-failure text; rule 180238 flags any log reference to the Emergency Number List IE so that SOC analysts can correlate the two events for a confirmed CVE-2023-37024 trigger.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED). The only patch reference is an OSV entry citing Magma v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486. This has not been independently confirmed against a vendor advisory or a public commit-diff analysis as of this report. Proceed with the upgrade, but validate the fix by reviewing the actual diff and by regression-testing NAS handling after deployment.

1) Immediate mitigations (before patching):

• If the affected MME is deployed in a private/lab environment, isolate the S1-MME (SCTP) interface from untrusted eNodeBs or backhaul segments with a stateful firewall, allowing only known eNodeB source IPs.
• Enable the MME's crash-dump and core-dump collection so that any assertion event is captured for analysis.
• Place a temporary monitoring rule (see Detection Guidance) on MME logs and alert on any assertion-failure event; treat three or more MME restarts within an hour as a suspected ongoing DoS campaign.
• There are no vendor-provided configuration workarounds listed in the CVE data ("Workarounds: N/A"), so network-level controls and monitoring are the only interim options.

2) Patch / upgrade steps:

• Upgrade Magma to v1.9 or later, specifically incorporating commit 08472ba98b8321f802e95f5622fa90fec2dea486.
• If you manage Magma via the standard release process, apply the v1.9 release and verify the running binary against the fix commit hash before returning the MME to service.
• After patching, re-run a NAS-signalling regression test (including attach procedures with Emergency Number List IE present) to confirm the assertion no longer fires.

3) Long-term hardening:

• Add fuzzing of the NAS layer (S1AP-encapsulated NAS PDUs) to your CI pipeline so that parser crashes in the MME are caught before release.
• Subscribe to Magma security advisories and OSV for v1.9.x onward; re-audit the MME for similar assertion-based crash classes in other NAS IEs.
• Segment the core network: the MME should never be directly reachable from the Internet, and S1AP/SCTP traffic should be restricted to designated eNodeB and AGW subnets.
• Evaluate the deployment for SDN/orchestration-level restart policies that automatically quarantine an MME exhibiting repeated crash loops.

References

1. NVD Entry — CVE-2023-37024: https://nvd.nist.gov/vuln/detail/CVE-2023-37024
2. OSV Advisory for CVE-2023-37024 (patch source, commit 08472ba98b8321f802e95f5622fa90fec2dea486): https://osv.dev/vulnerability/CVE-2023-37024
3. Magma Project GitHub Repository (source of fix commit): https://github.com/magma/magma
4. FIRST EPSS — CVE-2023-37024 score context (0.00712, 50.6th percentile): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2023-37024 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

As of the data analysed, there are no known threat-actor campaigns or confirmed exploit-in-the-wild instances for CVE-2023-37024. The CISA KEV flag is NO. Organisations should nevertheless treat this as a credible unauthenticated DoS vector for Magma-based cores and apply the v1.9 fix promptly, while maintaining the monitoring rules above to detect both opportunistic attempts and any future weaponised PoC that may emerge.