CVE-2023-37032

Executive Summary

CVE-2023-37032 is a stack-based buffer overflow in the Mobile Management Entity (MME) of the Magma open-source mobile core network, affecting versions up to and including 1.8.0. A remote, unauthenticated attacker who can radio-access an operator network served by a vulnerable Magma deployment can send a NAS packet containing an oversized Emergency Number List Information Element, causing the MME process to crash. The NVD description references a fix in Magma v1.9 (commit 08472ba98b8321f802e95f5622fa90fec2dea486), but tracked patch sources have not independently confirmed an advisory; no CVSS score is assigned, no public PoC is confirmed, and the CVE is not in the CISA KEV catalog.

Technical Analysis

Magma is a Linux Foundation–hosted open-source project that provides a 3GPP-compliant Evolved Packet Core (EPC) and 5G core, typically deployed on commodity hardware in telecom labs, private LTE/5G networks, and edge deployments. The MME is the control-plane network function that terminates the S1-MME interface from eNodeBs and the NAS (Non-Access Stratum) protocol from user equipment (UEs). It handles attach, authentication, tracking-area updates, paging, and bearer management. Because the MME sits at the heart of the control plane, a crash directly degrades or removes service for every subscriber served by that element.

The vulnerability is a classic stack-based buffer overflow (CWE-121) in the MME’s NAS message parser. The 3GPP NAS protocol (TS 24.301) carries an Emergency Number List Information Element inside certain EMM messages. This IE is semi-optional and can be broadcast or sent to UEs; critically, the parser that handles it allocates a fixed-size destination buffer on the process stack and copies the incoming IE contents into it without first validating that the IE’s declared length fits within that buffer. When a crafted NAS packet sets the IE length field to a value exceeding the stack buffer capacity, the copy operation writes past the end of the buffer, corrupting adjacent stack data such as saved registers and the return address.

No specific function names, file paths, or source lines are provided in the NVD description, so the precise parser routine is not publicly identified in this data. The applicable vulnerability class, however, is unambiguous: lack of bounds checking during NAS IE parsing within the MME. The attack surface is the MME’s radio-facing control-plane interface. In a production deployment the MME is not typically exposed to the public internet, but it is reachable from the RAN (radio access network), which can include hostile or compromised endpoints. A standard cellphone can generate NAS signaling without credentials because some NAS messages are processed before the UE completes authentication — the NVD description explicitly notes the attacker is an “unauthenticated cellphone.” In lab, misconfigured, or MEC (multi-access edge computing) topologies, S1AP endpoints may also be reachable over IP networks, expanding the attack surface. The MME typically listens on SCTP port 36412 (S1AP signalling) or 38412, which are the transport endpoints a remote attacker would target.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is known at the time of writing, and the CVE is not listed in CISA’s KEV. The attack chain below is therefore inferred from the vulnerability class and the NVD description; it should be treated as an analytic reconstruction rather than a confirmed exploit sequence.

1. Reconnaissance / target identification: An attacker with a cellular device or software-defined radio first identifies the target operator’s PLMN and selects the Magma-served network. Alternatively, in deployments where the S1-MME endpoint is IP-reachable, the attacker can scan for SCTP services on ports 36412/38412 from a compromised host inside the transport network. Because the trigger is an unauthenticated NAS packet, the attacker does not need valid SIM credentials for the operator.

2. Triggering the specific flaw: The attacker causes the UE to transmit a NAS message that includes an Emergency Number List Information Element whose length field is set substantially larger than the legitimate maximum. The MME receives the message over S1AP, parses the NAS container, and dispatches the IE to its handling routine. The routine copies the IE payload into a fixed-size stack allocation without verifying the declared length against the destination capacity, initiating the overflow.

3. Payload / execution method: This is a stack-based buffer overflow. The overflowing data corrupts stack metadata adjacent to the destination buffer — typically the saved frame pointer and return address. The minimal outcome, and the only outcome explicitly described in the NVD data, is a crash of the MME process due to corrupted control data. Code execution is theoretically possible if the attacker controls the overflow bytes and stack layout permits a hijack, but no public research has demonstrated such escalation for this CVE, so RCE must be regarded as speculative.

4. Post-exploitation impact: The MME process terminates, and the platform’s supervision may restart it or leave it in a failed state. While it is down, the serving network cannot process attach requests, tracking-area updates, paging, or authentication for affected UEs, producing a service-outage (denial-of-service) condition. Repeatedly sending the malformed packet yields a persistent or intermittent availability loss across the affected tracking areas. An attacker with network-level access could also use this as a harassment or competitive-disruption tool against a private/MNO deployment.

Impact Assessment

The business impact is primarily availability: crashing the MME denies mobile service to all subscribers attached to any eNodeB served by the vulnerable MME instance. For a private LTE/5G deployment (factory, campus, energy, public-safety), this halts mission-critical connectivity; for an MNO, it degrades a geographic region. The confidentiality and integrity impact is not established by public data, but a stack overflow in a control-plane process is a class of bug with escalation potential, so security teams should not assume the impact is limited to a crash.

CVSS is listed as N/A (no vector or score assigned). The EPSS score is 0.00758 (52.2nd percentile of exploited CVEs), indicating a low current probability of in-the-wild exploitation, consistent with the absence of KEV listing and public PoC. That said, low EPSS is not a substitute for patching in an environment that exposes a radio-facing control plane. The effect of exploitation is deterministic (remote crash injectable by a commodity phone), so the effective risk for operators is higher than the generic exploit-probability score suggests. The blast radius is all UEs registered to the affected MME, not just the attacking device.

Detection Guidance

The rules below are templates that assume visibility into MME application logs, process telemetry, and SCTP/S1AP-bearing network flows. Field names and log sources must be adapted to local deployment naming. Because no Magma-specific log schema is provided in the NVD data, the rules use generic placeholders where appropriate.

Sigma Rule

title: Magma MME NAS Emergency Number List Oversized IE or Process Crash
id: 8f3a0c20-3e6d-4e1a-9a55-3e1de4f7c001
status: experimental
description: >
  Detects MME log activity consistent with CVE-2023-37032 - reception of a NAS
  message containing an oversized Emergency Number List Information Element,
  or an MME process crash/abort that may result from the stack overflow.
logsource:
    category: application
    product: magma
    service: mme
detection:
    selection_malformed_nas:
        message|contains|all:
            - 'Emergency Number List'
            - 'invalid'
            - 'length'
    selection_decode_error:
        message|contains|all:
            - 'NAS'
            - 'decode'
            - 'failure'
    selection_crash:
        message|contains:
            - 'stack smashing'
            - 'SIGSEGV'
            - 'SIGABRT'
            - 'abort'
    condition: selection_malformed_nas or selection_decode_error or selection_crash
fields:
    - src_ip
    - imsi
    - host.name
falsepositives:
    - Benign malformed NAS from defective third-party UE firmware
level: high

YARA Rule

rule CVE_2023_37032_Magma_MME_Oversized_Emergency_Number_List
{
    meta:
        description = "Detects NAS/S1AP payloads carrying an Emergency Number List IE with an anomalous length field (CVE-2023-37032). Tune threshold to deployment."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-37032"
        date = "2025-01-01"

    strings:
        $nas_eml_iei = { 34 }   // Emergency Number List IEI (3GPP TS 24.301); length byte follows

    condition:
        $nas_eml_iei and uint8(@nas_eml_iei[1] + 1) > 60
}

Notes: the rule assumes the IE appears in a raw SCTP/S1AP payload capture (PCAP). The IEI value 0x34 follows 3GPP TS 24.301; if a non-standard stack is in use, validate the IEI against the protocol implementation. The threshold of 60 is illustrative — replace with the actual maximum legitimate IE length for the target build, or with the known stack-buffer size if it is ever disclosed.

Suricata IDS Rule

# Requires SCTP protocol support; S1AP/NAS decoders are ideal.
# $MME_SERVERS should be defined as the IP address space of the S1-MME endpoints.
alert sctp $EXTERNAL_NET any -> $MME_SERVERS 36412 ( \
    msg:"MALFORMED-NAS Magma MME Emergency Number List oversized IE attempt (CVE-2023-37032)"; \
    content:"|34|"; \
    byte_test:1,>,60,1,relative; \
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-37032; \
    classtype:attempted-dos; \
    sid:3703201; rev:1; \
    metadata:created_at 2025_01_01, updated_at 2025_01_01)

Notes: if the MME listens on port 38412, create a mirror rule for that port. If the sensor cannot decode SCTP payloads, apply the rule to the raw SCTP chunk payload and verify offset alignment with captured NAS traffic before deploying. The rule is intentionally simple; malformed-packet detection can be augmented with an alert on any NAS message whose IE length exceeds the SCTP packet remaining-length (a sign of a length field that does not match the actual datagram).

Elastic Detection

EQL — repeated MME process termination/restart within a short window:

sequence by host.name with maxspan=10m
  [ process where event.type == "start" and process.name == "mme" ]
  [ process where event.type == "end" and process.name == "mme" and process.exit_code != 0 ]

EQL — log correlation for malformed NAS IE and crash signature:

any where process.name == "mme" and (
  message like "*Emergency Number List*" or
  message like "*stack smashing*" or
  message like "*SIGABRT*" or
  message like "*SIGSEGV*"
)

Splunk SPL Query

Detection of anomalous NAS IE events or crash markers on the MME:

index=magma sourcetype=mme:*
  ("Emergency Number List" OR "NAS decode" OR "stack smashing" OR "SIGABRT" OR "SIGSEGV")
| bin _time span=5m
| stats count as event_count, dc(src_ip) as src_ips, values(src_ip) as src_ip_list
        by _time, host
| where event_count > 5 OR src_ips > 1
| sort - _time

Correlation with MME process supervision telemetry:

index=magma sourcetype=systemd:journal process_name=mme
  (message="Started" OR message="Stopped" OR message="Failed" OR message="Main process exited")
| stats count as restart_count by host, _time
| where restart_count > 3
| sort - restart_count

Wazuh OSSEC Rule

<group name="magma,mme,">
  <!-- Parent rule: single anomalous NAS event or crash marker -->
  <rule id="100369" level="6">
    <match>Emergency Number List</match>
    <regex>stack|buffer|abort|SIGSEGV|SIGABRT|crash</regex>
    <description>Magma MME: NAS packet with anomalous Emergency Number List IE or MME crash (possible CVE-2023-37032)</description>
    <group>availability,</group>
  </rule>

  <!-- Aggregation: repeated events suggest intentional exploitation -->
  <rule id="100370" level="12" frequency="5" timeframe="60">
    <if_matched_sid>100369</if_matched_sid>
    <same_source_ip/>
    <description>Magma MME: repeated Emergency Number List / crash events - likely CVE-2023-37032 exploitation attempt</description>
    <group>availability,vulnerability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references a fix in Magma v1.9 at commit 08472ba98b8321f802e95f5622fa90fec2dea486, but our patch-tracking pipeline has not independently confirmed a vendor advisory, a release note, or a backport. Treat the reference as a lead to verify, not as an audited patch.

1. Immediate mitigations:

   • If the MME is reachable over IP (not purely via radio), restrict SCTP access on ports 36412/38412 to trusted eNodeB/IP-transport ranges using firewalls or cloud security groups.
   • Apply eNodeB IP allow-listing or certificate/identity-based authorization on the S1-MME interface where the deployment supports it.
   • Deploy process supervision (e.g., systemd restart policies) so a crashed MME restarts automatically, and alert on restart loops.
   • Engage a network-based NAS/S1AP anomaly monitor capable of flagging IEs whose declared lengths exceed the message size or configured thresholds.
   • If feasible, run the MME with stack canaries and ASLR enabled and verify the binary does not disable them.

2. Patch/upgrade steps:

   • Verify whether your Magma build includes commit 08472ba98b8321f802e95f5622fa90fec2dea486 (git branch --contains or git log on the checkout).
   • If not already on v1.9, upgrade to a v1.9 or later release from the Magma project (https://github.com/magma/magma) in a staging environment first, then roll to production.
   • Confirm with the project’s release notes and any current security advisory before declaring the CVE remediated, given the 0/4 patch-confidence rating.

3. Long-term hardening:

   • Subscribe to Magma security advisories and the project’s GitHub release feed so future MME/AGW vulnerabilities are received directly.
   • Add NAS-parser fuzzing to your SDLC or continuous integration if you build Magma in-house; this bug class is prime fuzz-target material.
   • Segment the EPC control plane from general IT traffic and treat the RAN-facing segment as semi-hostile.
   • Maintain SCTP-level rate limiting and malformed-packet drop policies at the edge.
   • Monitor MME crash telemetry in Orchestrator/AGW and feed it into your SIEM with the detection rules above.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-37032
• Magma fix commit referenced in NVD description: https://github.com/magma/magma/commit/08472ba98b8321f802e95f5622fa90fec2dea486
• Magma Project (releases, issue tracker): https://github.com/magma/magma
• 3GPP TS 24.301 — NAS protocol for EPS; defines the Emergency Number List IE: https://www.3gpp.org/ftp/Specs/archive/24_series/24.301/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2023-37032 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns, malware signature, or exploit-in-the-wild evidence is associated with this CVE in the provided data. EPSS (0.00758, 52.2nd percentile) and the absence of a KEV listing suggest exploitation has not been broadly observed, but the vulnerability remains a credible availability risk for any Magma deployment that has not verified the v1.9 fix.