CVE-2023-37028

Executive Summary

CVE-2023-37028 is a null pointer dereference vulnerability in the Mobile Management Entity (MME) of Magma, an open-source mobile core network platform, affecting all releases up to and including v1.8.0. A network-adjacent attacker with access to the operator's S1-MME signaling network can crash the MME by sending a crafted S1AP E-RAB Modification Indication packet that omits the mandatory eNB_UE_S1AP_ID information element. The resulting denial of service disables the LTE control plane for every subscriber attached to the affected MME; the issue is fixed in Magma v1.9, and no public exploit or in-the-wild activity has been reported to date.

Technical Analysis

The MME is the LTE/4G control-plane anchor in the evolved packet core. It terminates the S1-MME interface toward eNodeBs using S1 Application Protocol (S1AP, 3GPP TS 36.413) messages carried over SCTP. The MME is responsible for attach procedures, authentication, tracking area management, paging, and radio bearer (E-RAB) lifecycle management. An attacker who can reach the transport network between a cell site and the core can inject or modify S1AP traffic because eNodeB-to-MME signaling is not per-message authenticated in standard deployments.

The vulnerability is a null pointer dereference triggered during S1AP message decoding. The E-RAB Modification Indication message is sent by an eNodeB to the MME to report that one or more E-RABs have been modified on the radio side. This message is expected to carry the eNB_UE_S1AP_ID information element, which identifies the UE context at the eNodeB and is used by the MME to correlate the message to the correct UE-specific context and associated S1 signaling connection. When a packet arriving on the S1-MME interface is parsed and this mandatory IE is absent, the MME's S1AP handler fails to resolve a UE context for the message; the subsequent code path dereferences the result of that lookup without a null check. In the case of a missing eNB_UE_S1AP_ID, the context lookup returns NULL, and the dereference causes a segmentation fault that terminates the MME process.

The NVD description does not provide function names, log identifiers, or a precise code-path walkthrough; the technical mechanism above is derived from the vulnerability class (null dereference in an S1AP message-processing path) and the affected message/IE pair explicitly named in the description. The affected component is the Magma MME, which in version 1.8.0 and earlier is exposed on the operator's S1-MME network segmentation. The fix is claimed to be present in Magma v1.9 at commit 08472ba98b8321f802e95f5622fa90fec2dea486. The OSV database entry maps the issue to a generic root package with an unresolved version range, so the exact set of affected Magma constituent binaries downstream of the OSS project is not fully enumerated in machine-readable form.

Attack surface summary: the flaw is reachable by any host that can deliver SCTP/S1AP traffic to the MME's S1-MME endpoint. This includes compromised cell-site routers, rogue or misconfigured eNodeBs, and any attacker with a foothold on the backhaul transport between the radio access network and the core. No authentication is required beyond the ability to open or inject into an SCTP association, making the MME a high-value, low-barrier DoS target in networks where the S1 segment lacks strict ACLs or IPsec.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the message-specific details in the NVD description.

1. Reconnaissance / target identification. The attacker maps the operator's transport network using passive SCTP traffic analysis or active port scanning for the standard S1AP signaling port. The MME endpoint is identified by its role in S1Setup exchanges with nearby eNodeBs; in a compromised cell-site scenario, the attacker may already possess an authenticated SCTP association with the MME as a legitimate eNodeB.

2. Triggering the flaw. The attacker crafts an S1AP E-RAB Modification Indication message and omits the eNB_UE_S1AP_ID information element from the protocol data unit. Because S1AP messages are ASN.1 PER-encoded, the message can be assembled with a modified eNodeB stack or a custom SCTP injection tool; the malformed message is then sent to the MME over the S1-MME interface. No memory-corruption payload is required — the message only needs to pass initial ASN.1 decoding so that the MME enters the message-handling routine where the missing-IE lookup occurs.

3. Execution / payload delivery. The malformed message is delivered as normal SCTP DATA on an existing S1 association (or a freshly established one from a rogue eNodeB). The MME's S1AP handler processes the message as a legitimate E-RAB modification indication, fails to resolve the UE context due to the absent eNB_UE_S1AP_ID, and dereferences the resulting NULL pointer.

4. Post-exploitation impact. The MME process terminates immediately. All S1 connections toward eNodeBs served by that MME are affected: new attach requests, tracking area updates, and paging operations fail, and connected-mode UEs lose mobility management. The operator experiences a control-plane outage across the MME's entire service area until the process restarts. If the attacker repeats the malformed message transmission, the MME may crash in a crash-restart loop, turning a single-packet vulnerability into a persistent denial of service.

Impact Assessment

The business impact is a full loss of LTE control-plane availability for the served region. Because the MME is a centralized core component, one crash affects not a single cell but every eNodeB and subscriber registered to that MME. Voice call setup, data bearer establishment, handover, and paging are all unavailable during the outage window; in a restart loop, all subscribers in the area are effectively de-registered and re-attach storms may propagate additional load to HSS and other core functions.

The NVD has not assigned a CVSS score or vector for this CVE, so no CVSS subscores are available. Exploitation likelihood is currently low: EPSS is 0.00400, placing the CVE in the 33.2nd percentile of exploited-CVE rankings, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog. Network adjacency is a meaningful constraint in well-segmented operator networks, but in smaller or private LTE deployments (CBRS, enterprise/neutral-host networks where the radio transport is shared or semi-trusted), the practical attack surface is significant. Confidentiality and integrity are not directly affected; the impact is entirely on availability.

Detection Guidance

Detection of this vulnerability is challenging because the malicious signal is a well-formed S1AP protocol data unit that merely omits one mandatory information element. Byte-level network signatures are unreliable without a full S1AP/ASN.1 decoder; the detection rules below therefore target observable consequences (MME process crashes, decode errors, SCTP anomalies) rather than a fixed packet byte-string. Signatures should be validated against local Magma logging and are suitable for tuning into production detection content.

Sigma Rule

Detects host-level indicators of MME crashes or S1AP processing failures in Linux syslog.

title: Magma MME Crash or S1AP Processing Error - CVE-2023-37028
id: 8f7c6a1e-4b32-4f81-9c2a-5d10c9e37a02
status: experimental
description: >
  Detects MME process termination events or S1AP decoding/handling errors
  consistent with a null-pointer dereference in the Magma MME (CVE-2023-37028).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-37028
author: vartersit.com threat intel
date: 2025/04/16
logsource:
  product: linux
  service: syslog
detection:
  selection_mme:
    keywords:
      - "mme"
      - "MME"
  selection_crash:
    keywords:
      - "SIGSEGV"
      - "segfault"
      - "signal 11"
      - "core dumped"
      - "Fatal signal"
  selection_s1ap:
    keywords:
      - "S1AP"
      - "E-RAB Modification Indication"
      - "eNB_UE_S1AP_ID"
  condition: selection_mme and (selection_crash or selection_s1ap)
falsepositives:
  - Legitimate operator-triggered MME restarts for maintenance
  - S1AP errors caused by defective/eNodeB firmware
level: high

YARA Rule

Identifies forensic artifacts — MME binaries, core dumps, and packet captures — that contain the S1AP procedure and IE identifiers implicated in CVE-2023-37028.

rule CVE_2023_37028_MME_S1AP_Artifacts {
    meta:
        author = "valtersit.com threat intel"
        description = "Matches MME binaries, core dumps, or capture files referencing the S1AP E-RAB Modification Indication procedure and the eNB_UE_S1AP_ID IE involved in CVE-2023-37028"
        reference = "CVE-2023-37028"
        date = "2025-04-16"

    strings:
        $proc1 = "E-RABModificationIndication" ascii wide
        $proc2 = "E-RAB Modification Indication" ascii wide
        $ie1   = "eNB_UE_S1AP_ID" ascii wide
        $ie2   = "eNB-UE-S1AP-ID" ascii wide
        $ie3   = "eNB UE S1AP ID" ascii wide

    condition:
        any of ($proc*) and any of ($ie*)
}

Suricata IDS Rule

Heuristic rule alerting on SCTP traffic directed at the standard S1-MME signaling port. A precise byte-level signature for the missing-IE condition is not feasible without an S1AP decoder, so this rule detects anomalous signaling volume and non-standard sources toward the MME.

# Heuristic detection for CVE-2023-37028.
# Flags sustained SCTP traffic toward the standard S1AP destination port 36412
# from a single source, which is consistent with injection of malformed
# E-RAB Modification Indication messages or automated re-crash attempts.
alert sctp any any -> $HOME_NET 36412 (
    msg:"CVE-2023-37028 Possible S1AP E-RAB Modification Indication injection to Magma MME";
    flow:to_server;
    threshold:type both, track by_src, count 10, seconds 60;
    reference:cve,2023-37028;
    classtype:attempted-dos;
    sid:10037028;
    rev:1;)

Elastic Detection

EQL query to identify MME process terminations with a non-zero exit status (endpoint telemetry), or host log entries referencing MME crashes / S1AP errors.

// Endpoint-level detection: MME process unexpectedly terminated
process where event.module == "endpoint"
    and event.type in ("end", "info")
    and process.name == "mme"
    and process.exit_code != 0

// Host-log detection: crash or S1AP error references in agent-collected logs
any where event.module == "system"
    and (wildcard(message, "*mme*SIGSEGV*")
        or wildcard(message, "*mme*segfault*")
        or wildcard(message, "*mme*S1AP*")
        or wildcard(message, "*mme*eNB_UE_S1AP_ID*"))

Splunk SPL Query

Searches for host crash indicators and S1AP anomalies, then correlates them with SCTP signaling traffic to the MME port.

(index=linux_syslog OR index=unix)
    "mme" ("SIGSEGV" OR "segfault" OR "S1AP" OR "eNB_UE_S1AP_ID")
| stats count by host, _time, source, message
| sort - _time

(index=netflow OR index=firewall) dest_port=36412
| bucket _time span=5m
| stats dc(src_ip) as src_ips, count as packets by _time, dest_ip
| where packets > 100 OR src_ips > 5
| sort - _time

Wazuh OSSEC Rule

Detects MME crash and S1AP anomaly lines in Linux syslog and flags them at high alert level.

<group name="cve-2023-37028,">
  <rule id="988316" level="12">
    <decoded-as>syslog</decoded-as>
    <match>mme|MME</match>
    <regex>SIGSEGV|segfault|core dumped|S1AP.*(error|failure)|eNB_UE_S1AP_ID</regex>
    <description>Magma MME crash or S1AP handling error — potential exploitation of CVE-2023-37028 (null pointer dereference)</description>
    <group>cve-2023-37028,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 — CLAIMED. The fix is referenced by a single source (OSV) as present in Magma v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486; it has not been independently confirmed against a vendor advisory, changelog, or release notes.

1) Immediate mitigations

• Restrict network access to the MME's S1-MME interface. Apply strict ACLs permitting SCTP signaling only from known eNodeB/eNB gateway IPs; deny all other sources at the transport segment boundary.
• If the S1-MME transport is not already encrypted, deploy IPsec (or at minimum SCTP-level filtering) between the radio access network and the MME to prevent packet injection by network-adjacent hosts.
• Consider an MME-side baseline of expected SCTP peers and establish monitoring for new or unexpected SCTP associations to the MME port.
• Ensure MME process supervision and rapid automatic restart are configured so that a single crash is not a sustained outage; treat repeat crashes as a likely active attack.

2) Patch / upgrade steps

• Upgrade Magma to v1.9 or later, incorporating commit 08472ba98b8321f802e95f5622fa90fec2dea486.
• Verify the upgrade with the vendor's release process and confirm the specific commit is present in the deployed build.
• Re-test S1AP interworking with reference eNodeB stacks after the upgrade to confirm normal E-RAB modification behavior is unchanged.
• Monitor the OSV entry for updates; re-run an independent confirmation of the patch before closing this CVE as remediated.

3) Long-term hardening

• Add mandatory-IE validation and null checks to the MME's S1AP decoder so that missing critical IEs such as eNB_UE_S1AP_ID are rejected with a protocol error rather than dereferenced.
• Integrate S1AP fuzzing (malformed/missing-IE message generation) into the CI pipeline for Magma core components.
• Deploy MME redundancy / geo-redundant control-plane failover so that single-node crashes do not drop all subscribers.
• Segregate the S1-MME transport into a dedicated security zone with its own IDS visibility, and alert on SCTP anomalies and MME process restarts as a control-plane health baseline.

References

• NVD — CVE-2023-37028: https://nvd.nist.gov/vuln/detail/CVE-2023-37028
• OSV — CVE-2023-37028 OSV entry: https://osv.dev/vulnerability/CVE-2023-37028
• Magma GitHub — fix commit 08472ba98b8321f802e95f5622fa90fec2dea486: https://github.com/magma/magma/commit/08472ba98b8321f802e95f5622fa90fec2dea486
• 3GPP TS 36.413 — Evolved Universal Terrestrial Radio Access Network (E-UTRAN); S1 Application Protocol (S1AP) — background protocol reference: https://www.3gpp.org/DynaReport/36413.htm
• CISA Known Exploited Vulnerabilities catalog (CVE-2023-37028 is not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns or exploit-in-the-wild evidence has been identified for CVE-2023-37028 as of this report. Exploitation likelihood per EPSS is low (0.00400, 33.2nd percentile), and the vulnerability is not present in the CISA KEV catalog.