CVE-2023-37029

Executive Summary

CVE-2023-37029 is a denial-of-service vulnerability affecting Magma core-network software versions 1.8.0 and earlier. The flaw resides in the Mobility Management Entity (MME) component of the 4G/5G core: receipt of an oversized Non-Access Stratum (NAS) signaling packet triggers an assertion failure that aborts the MME process. An attacker can deliver such packets either from a compromised base station on the trusted S1-MME transport path or from an unauthenticated cellular device within radio range of a base station managed by the target MME. Repeated exploitation causes the MME to crash-loop, taking down attach, mobility, and session management for every subscriber in the affected tracking area — a pure availability impact with no known credential or code-execution requirements. The NVD description references a fix in v1.9 (commit 08472ba98b8321f802e95f5622fa90fec2dea486), although independent patch tracking reports 0/4 confidence; organizations should treat the upgrade path as mandatory regardless.

Technical Analysis

Vulnerability class. The disclosed mechanism is an assertion-based crash: the MME process terminates itself when an internal invariant is violated while processing an oversized NAS packet. This maps to the classic CWE-617 (Reachable Assertion) weakness class. In protocol stacks, assertions are typically placed in parsers to enforce invariants such as "message length field is consistent with the received buffer size" or "message type is valid for the current state machine." When an attacker controls the length fields or padding of a signaling protocol data unit, the assertion fails and the process aborts instead of handling the malformed input gracefully. An attacker who causes even one such abort immediately achieves denial of service at the control-plane node.

Affected component. The MME is the central control-plane node in the 4G Evolved Packet Core (EPC). It terminates the NAS protocol between the subscriber device (UE) and the core, manages attach/detach, tracking area updates, authentication, bearer establishment, and handover. In the Magma architecture, the MME (often deployed as a containerized service, historically mme in the Magma orchestrator) communicates with base stations (eNodeBs) over the S1-MME interface, which uses SCTP with S1AP encapsulation. NAS messages are carried transparently inside S1AP; the MME decoder must parse both S1AP framing and the NAS PDU itself.

Attack surface. The NVD description enumerates two delivery paths:

1. Compromised base station — a base station already under attacker control has a legitimate, trusted SCTP association to the MME. From that position, the attacker can inject arbitrary S1AP messages containing malformed/oversized NAS PDUs as if they came from a legitimate network element. No subscriber-side radio equipment is needed, and the packets arrive directly on the control-plane transport network.

2. Unauthenticated cellphone within range — a standard UE (or a software-defined radio running a rogue UE stack) within RF coverage of a base station managed by the target MME. The baseline 4G attach procedure intentionally permits an unauthenticated device to transmit an initial NAS message (e.g., Attach Request) before authentication completes; this is inherent to the protocol so that the network can challenge the device. An attacker can therefore send an oversized or malformed NAS PDU without any subscription credentials. The base station forwards the message toward the MME, where the parser crashes.

Why the assertion is reachable. The MME's NAS decoder must handle messages whose declared lengths arrive over a stateful radio/transport chain. If the decoder assumes that a length field is bounded by the maximum realistic NAS message size and validates that assumption with an assertion rather than an error-return, a crafted message with an excessive declared or actual length triggers the abort. The absence of an explicit CWE/CVSS assignment in the source data leaves room for inference, but the disclosed behavior — "assertion-based crash" on "oversized NAS packet" — is fully consistent with missing input-length validation before buffer processing. Insufficient technical detail is available in the NVD description to name the specific parser function or buffer size; the analysis above is the vulnerability-class-level mechanism.

Availability profile. Because an assertion terminates the whole MME process (not just the SCTP connection), a single packet is sufficient for a single crash. There is no evidence that memory corruption occurs or that the flaw is exploitable for code execution; the impact is squarely a process-abort DoS. The EPSS score of 0.00606 (46.1st percentile) indicates a low-to-moderate likelihood of exploitation in the wild, and the CVE is not present in CISA KEV.

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2023-37029. The attack chain below is inferred from the vulnerability class and the two disclosed delivery vectors; it should be treated as a scenario reconstruction, not a step-by-step reproduction of a known exploit.

Step 1 — Reconnaissance and target identification. The attacker selects a mobile operator whose core network runs Magma <= 1.8.0. On the transport plane, the MME listens for SCTP associations on the S1-MME port (typically 36412); an attacker who can reach the management/transport network can probe for SCTP listeners and potentially fingerprint the Magma MME. For the radio vector, the attacker determines the operator's LTE band and identifies a target eNodeB; this requires physical proximity, a compatible UE/SDR, and valid cell parameters (PLMN, TAC) obtainable from broadcast system information.

Step 2 — Flaw trigger. The attacker crafts an oversized NAS message. At the class level, this means a NAS PDU whose length exceeds the parser's expected maximum — either through an inflated length field, an oversized information element, or an abnormally long payload appended to a legitimate NAS message type (the exact malformation is not disclosed). The message is delivered either (a) directly into the S1-MME SCTP association from a compromised base station, or (b) encapsulated in an uplink RRC/NAS transmission from a rogue UE, which the legitimate base station then forwards over S1-MME toward the MME. Critically, the UE that initiates this does not need to be authenticated, because initial NAS signaling is permitted before the authentication procedure.

Step 3 — Execution method. The oversized NAS PDU reaches the MME's NAS decoder. The decoder's length-invariant assertion evaluates to false, and the MME process aborts. A single malformed packet is sufficient to crash the node once; an automated radio or scripted transport injection can resend the offending packet on a cadence that outpaces the platform's restart/self-healing loop, placing the MME in a crash-restart cycle.

Step 4 — Post-exploitation impact. With the MME down, the affected tracking area(s) can no longer process Attach Requests, Tracking Area Updates, or Service Requests. Handovers fail, new sessions cannot be established, and existing sessions eventually drop as their bearers expire. The result is a carrier-grade availability outage: subscribers lose data access and voice-over-LTE signaling, IoT devices cannot reconnect, and the operator's network operations center sees repeated MME pod/process restarts. No data confidentiality or integrity impact is implied by the disclosed mechanism.

Note on exploit status: No public PoC available; attack chain is inferred from vulnerability class and the NVD description's explicit mention of "compromised base station" and "unauthenticated cellphone" vectors.

Impact Assessment

Business impact. The MME is a single point of failure for the entire LTE control plane it serves. A successful, repeated exploitation of CVE-2023-37029 degrades or eliminates mobile service for all subscribers attached through the affected MME's tracking area. For operators running Magma as a private/core network (enterprise neutral-host, IoT, fixed-wireless, or rural deployments), this translates directly into lost revenue, violated SLAs, and potential safety-of-life issues if emergency calling or public-safety services rely on the network. The attack requires no authentication and, in the radio vector, no compromise of operator infrastructure — only proximity to a base station. Repeated crashes also create an operational burden: paging storms, re-attach floods, and NOC alert fatigue on restart.

Affected systems. All Magma deployments running versions <= 1.8.0 with an MME exposed on S1-MME transport or subject to radio-originated NAS traffic. The OSV packaging data confirms the unfixed state for the root package (/, 0→unfixed), reinforcing that downstream distributions have not yet shipped a remediated package. The vulnerability is not in CISA KEV, and no public exploit code exists, which lowers immediate threat-actor adoption — but the attack is simple in concept and does not depend on advanced tooling beyond an SDR or a pre-existing base-station foothold.

Blast radius and scoring. The source data does not assign a CVSS score or vector; per the required metadata format, CVSS is reported as N/A. Based on the disclosed class (network-reachable assertion DoS, no auth, high availability impact), a hypothetical CVSSv3 scoring would likely fall in the high range on the availability metric, but this report does not substitute an unassigned score. The EPSS estimate of 0.00606 with a 46.1% percentile ranking indicates that, while the CVE is not in the most-likely-to-be-exploited tier, it is statistically more likely to be exploited than roughly half of all actively-tracked CVEs — a rationale for prioritizing the fix in telecom-adjacent environments.

Detection Guidance

The following rules detect the observable artifacts of CVE-2023-37029 exploitation: MME process aborts, assertion-failure log lines, oversized S1-MME/SCTP payloads, and abnormal restart loops. Where exact log strings are unavailable from the source data, the rules rely on generic assertion/crash indicators and on the MME identity; tailor the field names to your specific logging pipeline.

Sigma Rule

title: Magma MME Process Termination - CVE-2023-37029 DoS Indicator
id: 3f9c4b2a-7d4e-4f80-9c2a-1b7c8d9e0f11
status: experimental
description: Detects termination of the Magma MME process, consistent with assertion-based crashes caused by oversized NAS packets (CVE-2023-37029).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37029
tags:
    - attack.t1499
logsource:
    product: linux
    category: process_termination
detection:
    selection_process:
        process.name:
            - 'mme'
    selection_crash:
        process.exit_code:
            - 134          # SIGABRT (assertion failure)
            - 139          # SIGSEGV fallback
    condition: all of selection_*
level: high
falsepositives:
    - Administrative restarts/deployments of the MME service
    - Resource-exhaustion crashes unrelated to the CVE

YARA Rule

rule CVE_2023_37029_Magma_MME_Assertion_Indicators
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Matches strings commonly present in Magma MME crash artifacts, core dumps, or logs surrounding assertion-based NAS parsing failures (CVE-2023-37029)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-37029"
        date = "2025-01-01"
    strings:
        $a = "Assertion failed" ascii nocase
        $b = "mme" ascii nocase
        $c = "NAS" ascii nocase
        $d = "S1AP" ascii nocase
        $e = "core dumped" ascii nocase
    condition:
        (uint16(0) == 0x7f45 and $b and ($a or $e)) or
        ($a and $b and ($c or $d))
}

Suricata IDS Rule

alert sctp any any -> any 36412 ( \
    msg:"ET DOS Magma MME Oversized NAS/S1AP Payload in Progress - CVE-2023-37029"; \
    flow:to_server; \
    dsize:>1400; \
    threshold: type both, track by_src, count 5, seconds 60; \
    classtype:attempted-dos; \
    reference:cve,2023-37029; \
    sid:3702901; rev:1;)

alert sctp any any -> any 36412 ( \
    msg:"ET DOS Magma MME SCTP Association Churn - Possible CVE-2023-37029 Crash Loop"; \
    flow:to_server; \
    sctp.chunk_type:3; \
    threshold: type both, track by_src, count 10, seconds 60; \
    classtype:attempted-dos; \
    reference:cve,2023-37029; \
    sid:3702902; rev:1;)

Note: The first rule flags oversized application payloads on the S1-MME port; the second flags repeated SCTP ABORT chunks, which correlate with MME process crashes terminating associations. Adjust dsize thresholds to your network's normal S1AP profile.

Elastic Detection

process where event.type == "end"
    and process.name == "mme"
    and (process.exit_code == 134 or process.exit_code == 139)

// Crash-loop detection: MME terminating more than 5 times in 10 minutes
process where event.type == "end"
    and process.name == "mme"
    and process.exit_code == 134
| stats count by host.name, process.name
| where count > 5

Splunk SPL Query

index=main sourcetype=syslog (process=mme OR component="MmeApp" OR "mme")
    ("Assertion failed" OR "assert" OR "core dumped" OR "SIGABRT" OR "Segmentation fault")
| stats count(_time) as crash_count, latest(_time) as last_crash by host, source
| where crash_count > 5
| sort - crash_count

// SCTP S1-MME anomaly view - oversized payloads and teardown bursts
index=netflow OR index=firewall dest_port=36412
| stats count by src_ip, dest_ip, sctp_chunk_type
| where count > 100

Wazuh OSSEC Rule

<group name="magma,">
    <rule id="100370" level="12">
        <decoded_as>syslog</decoded_as>
        <match>Assertion failed|assert|core dumped|SIGABRT</match>
        <regex>mme|MmeApp|NAS</regex>
        <description>Magma MME assertion failure - possible CVE-2023-37029 oversized NAS packet denial of service</description>
        <group>dos,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence and status. The source dataset reports patch confidence 0/4 (UNPATCHED — no patch evidence from any tracked source), and the OSV record for the root package shows 0→unfixed. This is in tension with the NVD description, which explicitly names a fixed version (v1.9) and a specific fix commit (08472ba98b8321f802e95f5622fa90fec2dea486). Treat the v1.9 release as the intended vendor remediation, but verify its availability in your channel (container registry, Helm chart, or source build) before assuming the fix is deployed.

Immediate mitigations (while unpatched):

1. Segment the S1-MME transport. Place the MME's SCTP listener on an isolated management/transport VLAN with strict ACLs that allow inbound SCTP only from known, authenticated eNodeB IP ranges. This neutralizes the "compromised base station" vector from any node outside the allowlist.
2. Enable crash-loop supervision. Ensure the MME runs under a supervisor/orchestrator (e.g., Kubernetes liveness/readiness probes) with automatic restart and exponential backoff, so a single malformed packet does not permanently idle the node.
3. Add rate limiting. Restrict new SCTP association rates and uplink message rates on the S1-MME interface at the network level to blunt large-scale repeated injection.
4. Monitor and alert. Deploy the Sigma/Splunk/Wazuh logic above to flag MME aborts exceeding 5 per hour; page on-call engineers immediately.

Patch/upgrade steps:

1. Validate the current deployment version (<= 1.8.0 is vulnerable).
2. Obtain Magma v1.9 from the official Magma project source or distribution channel that includes commit 08472ba98b8321f802e95f5622fa90fec2dea486.
3. Test the upgrade in a staging environment with representative NAS traffic (attach, TAU, service request) before production rollout.
4. Apply the upgrade during a maintenance window, then verify the MME's version string and re-run the detection rules to confirm no residual assertion failures.
5. If v1.9 cannot be obtained in your environment, request a backported patch from the vendor/distributor; do not rely on network controls alone.

Long-term hardening:

• Work with the vendor to convert assertion-based length validation in the NAS parser to graceful error handling (reject-and-log rather than abort).
• Institute fuzz testing of the Magma NAS/S1AP decoders in CI/CD, using malformed length fields as a core test corpus, to prevent regression.
• Restrict radio-layer exposure by ensuring operators use authenticated RRC procedures and monitor for anomalous UE signaling rates.
• Re-evaluate the MME's architectural redundancy (e.g., pooling or geographic redundancy) so that a single-node crash does not equate to a full tracking-area outage.

References

1. NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2023-37029
2. Magma project source and release documentation (referenced fix commit 08472ba98b8321f802e95f5622fa90fec2dea486 in v1.9): https://github.com/magma/magma
3. Magma official project site: https://magmacore.org
4. FIRST EPSS score for CVE-2023-37029 (0.00606): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2023-37029 is NOT listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor activity note: As of this writing, no threat-actor campaigns, exploit-in-the-wild evidence, or public exploit code are known for CVE-2023-37029. The vulnerability is not present in CISA KEV, and the EPSS estimate is low in absolute terms. Nevertheless, the attack is conceptually trivial to implement (a malformed NAS length field over SCTP or via a rogue UE), so monitoring for the crash artifacts above is warranted, particularly in Magma-powered private LTE/5G deployments.