CVE-2023-37033

Executive Summary

CVE-2023-37033 is a NULL pointer dereference vulnerability in the Mobile Management Entity (MME) component of the Magma mobile core network platform, affecting Magma versions up to and including 1.8.0. A network-adjacent attacker can crash the MME by transmitting a crafted S1AP Initial UE Message packet that omits the mandatory EUTRAN_CGI information element, resulting in a denial-of-service (availability loss) for all subscribers managed by the targeted MME. No CVSS score, CWE identifier, or public proof-of-concept is currently available; exploitation-in-the-wild evidence is not recorded in the CISA KEV catalog, and the EPSS score of 0.00373 (30.5th percentile) indicates a low immediate exploitation likelihood at the time of analysis.

Technical Analysis

The Magma project provides an open-source mobile core network (EPC/5G core) implementation used in carrier-grade and private LTE/5G deployments. The Mobile Management Entity (MME) is the central control-plane node of the Long-Term Evolution (LTE) Evolved Packet Core (EPC); it is responsible for UE authentication, attachment, tracking-area updates, paging, bearer establishment, and handover signaling.

The vulnerable interaction occurs on the S1-MME control-plane interface, which carries S1 Application Protocol (S1AP) signaling between eNodeBs (base stations) and the MME. Among the S1AP messages processed by the MME is the Initial UE Message, which is the first uplink message transmitted by a UE through an eNodeB and is used to relay the initial NAS (Non-Access Stratum) message to the MME. Per the S1AP protocol specification, the Initial UE Message is expected to carry a number of information elements (IEs) that identify the originating cell and UE, including the E-UTRAN Cell Global Identifier (EUTRAN_CGI).

In Magma versions <= 1.8.0, the MME code path that handles an incoming Initial UE Message does not robustly validate the presence of the expected EUTRAN_CGI field before dereferencing the associated data structure. When a received packet lacks this field, the MME dereferences a NULL pointer. In a typical C/C++ implementation of an S1AP stack, this condition results in a segmentation fault and terminates the MME process. The NVD description explicitly identifies this as a NULL pointer dereference, which maps to CWE-476 (NULL Pointer Dereference) even though no CWE was formally assigned in the source data.

The attack surface is limited to "network-adjacent" attackers — i.e., a threat actor that can reach the S1-MME interface at the network layer (typically an SCTP transport on the S1AP well-known port) and inject or forge S1AP signaling traffic that appears to come from a legitimate eNodeB. This can include compromised eNodeBs, attackers with access to the transport network segment connecting radio access and core nodes, or malicious insiders in an operator's infrastructure. Because S1AP signaling is not cryptographically authenticated per-message in many deployments (relying instead on network segmentation and IP/SCTP access control), an attacker with the ability to speak SCTP/S1AP to the MME can deliver the malformed message.

The impact of successful exploitation is a crash of the MME process. Because the MME is a control-plane anchor, its failure interrupts attachment, authentication, mobility management, and paging for all UEs registered with that MME or attempting to register within its service area. The crash is trivially repeatable: as long as the attacker retains network adjacency, they can re-send the malformed packet and re-trigger the fault, effectively sustaining a denial of service on the mobile core control plane.

The NVD description states that the issue is fixed in Magma v1.9 at commit 08472ba98b8321f802e95f5622fa90fec2dea486. However, the patch confidence in the tracked intelligence data is 0/4 — no patch evidence was independently corroborated from the tracked patch sources, and the affected-versions list is empty in the source data. Organizations should therefore treat the referenced upstream commit as the candidate fix and validate it against their deployment, while continuing to monitor for official release notes.

Exploitation Scenarios

No public proof-of-concept or exploit code has been published for CVE-2023-37033 (PoC/Exploit status: UNKNOWN; Nuclei template: NO; exploit code: NO). The attack chain described below is therefore inferred from the vulnerability class (NULL pointer dereference in an S1AP message handler) and the NVD description; it is a representative chain, not a reproduction of a public exploit.

1. Reconnaissance / target identification. The attacker identifies an MME reachable on the S1-MME interface. This is accomplished by scanning the operator's transport/backhaul segment for SCTP endpoints carrying S1AP — services on the standard S1AP SCTP port (the IANA-assigned S1AP port is 36412) or by passively observing S1AP signaling. In Shodan-style reconnaissance, queries such as sctp s1ap or port:36412 may surface exposed control-plane services. The attacker must be network-adjacent, meaning they already have a foothold on a network segment that routes to the S1-MME interface or on a segment hosting an eNodeB.

2. Triggering the flaw. The attacker crafts an S1AP Initial UE Message that omits the expected EUTRAN_CGI information element. The packet is constructed so that the S1AP protocol data unit (PDU) is otherwise well-formed enough to reach the MME message-handling logic, but the missing IE causes the handler to follow a NULL pointer when it attempts to read the cell identifier. Because S1AP is an ASN.1 PER-encoded protocol, the attacker must encode the message so that the IE is genuinely absent rather than merely empty; the vulnerable code path does not reject the incomplete message with a decode error.

3. Payload / execution method. At the vulnerability-class level, this is a malformed-input NULL dereference: the "payload" is a protocol-valid-but-incomplete signaling message. No memory-corruption primitive or code execution is implied by the description — the likely outcome is a crash of the MME process (segmentation fault) rather than arbitrary code execution. The attacker sends the crafted SCTP/S1AP packet to the MME; in the absence of robust input validation in the MME's S1AP decoder/handler, the NULL dereference terminates the process.

4. Post-exploitation impact. The MME process crashes, and the MME enters a failed/restarting state. All UEs attached to the MME lose control-plane services: new attachments are rejected, handovers and tracking-area updates fail, paging cannot be delivered, and existing bearers may be dropped or orphaned depending on operator redundancy design. If the MME restart is automatic, the attacker can repeatedly send the malformed packet to re-crash the process, creating a sustained denial-of-service condition against the served tracking areas. There is no indication in the available data that the flaw enables lateral movement, data exfiltration, or subscriber-data compromise; the impact is confined to availability of the mobile core control plane.

It is acceptable to note the absence of public exploit artifacts: the attack chain above is inferred strictly from the vulnerability class and the NVD description, not from observed in-the-wild activity. The CISA KEV catalog does not list this CVE, and no threat-actor campaign referencing CVE-2023-37033 has been identified in the source data.

Impact Assessment

• Business impact: The MME is the control-plane hub of an LTE/EPC network. A crash of the MME disables core mobility and session-management functions for an entire MME service area, affecting all subscribers in that region. For telecom operators, this constitutes a significant availability incident with direct impacts on voice (VoLTE), data session establishment, emergency-call routing, and roaming. For private LTE/5G deployments (industrial, enterprise, or critical-infrastructure networks built on Magma), the impact scales with the operational criticality of the served assets — an MME outage can halt IoT connectivity, SCADA telemetry, or mission-critical communications.
• Affected systems: Magma MME components running versions <= 1.8.0. The affected-versions list in the source data is empty, so the authoritative range is the one stated in the NVD description: "Magma <= 1.8.0," with the fix attributed to v1.9.
• Blast radius: The blast radius is the set of eNodeBs and UEs served by the targeted MME. Because the S1-MME interface is typically shared or reachable from the operator's transport network, a single malformed packet can take down a centralized MME serving many cell sites. The attack is low-cost and repeatable, amplifying the effective impact from a one-off interruption to a persistent one.
• CVSS / risk context: No CVSS score or vector is published for this CVE (CVSS: N/A). The EPSS score is 0.00373 (30.5th percentile of exploited CVEs), indicating that mass exploitation has not been observed and is not currently probable. The CISA KEV catalog does not include this CVE (status: NO). Nevertheless, the vulnerability class (unauthenticated network-adjacent DoS on a core network element) warrants prioritized attention because of the severity of disruption and the relative simplicity of the trigger once network adjacency is achieved.

Detection Guidance

The detection rules below are templates. They should be tuned against a corpus of legitimate S1AP traffic and Magma MME logs to eliminate false positives before deployment. The absence of public exploit code and the ASN.1 PER binary nature of S1AP make signature-based detection of the exact malformed PDU difficult; detection should combine network-layer anomaly monitoring (SCTP/S1AP message shape) with host-layer MME process-health monitoring.

Sigma Rule

title: Magma MME Process Crash or S1AP Decode Error
id: 7f2b1c4e-9a8d-4f3e-b2c1-6a5d8e9f0a1b
status: experimental
description: >
  Detects Magma MME log entries indicating a NULL pointer dereference, crash,
  or S1AP decode/handling failure consistent with CVE-2023-37033
  (malformed S1AP Initial UE Message missing EUTRAN_CGI).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-37033
author: Valtersit Threat Intelligence
date: 2025/05/23
logsource:
  category: application
  product: magma
  service: mme
detection:
  selection_crash:
    - "MME": "*"
    - "S1AP": "*"
    - "Initial UE Message": "*"
  selection_error:
    - "null": "*"
    - "segfault": "*"
    - "Segmentation fault": "*"
    - "EUTRAN_CGI": "*"
    - "decode": "*"
    - "abort": "*"
  condition: selection_crash and selection_error
falsepositives:
  - Legitimate MME restarts during maintenance (unlikely to include NULL pointers and S1AP context simultaneously)
  - Transient S1AP errors caused by malfunctioning eNodeB firmware
level: high
tags:
  - attack.t1499
  - cve.2023-37033
  - cwe.476

YARA Rule

rule CVE_2023_37033_Magma_MME_S1AP_NULL_CGI
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects packet captures or tool artifacts containing S1AP Initial UE Message indicators and references to EUTRAN_CGI, consistent with CVE-2023-37033 (Magma MME NULL pointer dereference)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-37033"
        cve = "CVE-2023-37033"
        date = "2025-05-23"
    strings:
        $s1ap_msg = "Initial UE Message" ascii wide nocase
        $cgi_name = "EUTRAN_CGI" ascii wide nocase
        $cgi_ie  = "eutran-CGI" ascii wide nocase
        $mme_tag = "MME" ascii wide nocase
        $s1ap_abbr = "S1AP" ascii wide nocase
    condition:
        uint16(0) == 0x4d42 and              // file looks like a PCAP (little-endian magic)
        any of ($s1ap_msg, $s1ap_abbr) and
        any of ($cgi_name, $cgi_ie) and
        $mme_tag
}

Note: S1AP is binary ASN.1 PER; textual strings such as EUTRAN_CGI will only appear in tooling, logs, or packet forensics with dissector annotations, not in raw wire bytes. This YARA rule is intended to catch exploit tooling, PoC scripts, and annotated packet captures rather than raw malicious traffic. Operators should validate byte-level signatures against their own S1AP capture corpus before relying on them.

Suricata IDS Rule

# Template rule - tune the port and payload heuristics against your S1AP corpus.
# IANA-assigned S1AP SCTP port is 36412.
alert sctp any any -> any 36412 (msg:"ET TROJAN Magma MME S1AP Initial UE Message Missing EUTRAN_CGI (CVE-2023-37033)"; flow:to_server; content:"|00 00 00|"; depth:4; dsize:>30; metadata:engine_id cve-2023-37033; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-37033; classtype:attempted-dos; sid:37033001; rev:1;)

Note: Because S1AP messages are ASN.1 PER encoded, static content-matching against the Initial UE Message construct requires deriving the exact PER bytes for the target Magma release. The content and dsize values above are placeholders that MUST be replaced with byte patterns validated from legitimate vs. malformed S1AP captures. In practice, anomaly rules (SCTP flows to port 36412 from unexpected source IPs, malformed/truncated PDUs, high rates of S1AP from a single source) will yield better detection than a fixed content match.

Elastic Detection

sequence by host.name with maxspan=5m
  [ network where network.protocol == "sctp" and destination.port == 36412
    and network.direction == "ingress" ]
  [ process where event.category == "process" and event.type in ("end", "exit")
    and (process.name : "*mme*" or process.name : "*crashed*")
    and process.exit_code != 0 ]

Note: Adjust the process.name pattern to the actual MME service name used in your Magma deployment logs. If the MME runs as a container, match on container.name / orchestrator metadata instead.

Splunk SPL Query

(index=* sourcetype=*syslog* OR index=* sourcetype=magma*)
  ("MME" OR "S1AP")
  AND ("Initial UE Message" OR "decode" OR "decode_error")
  AND ("null" OR "NULL" OR "segfault" OR "Segmentation fault" OR "crash" OR "abort")
  OR
(index=netflow OR index=*netflow* dest_port=36412 OR dest_port=sctp-36412)
  | table _time, src_ip, dest_ip, dest_port, app, message
  | sort - _time

Wazuh OSSEC Rule

<group name="magma,mme,cve-2023-37033,">
  <rule id="370330" level="12" frequency="3" timeframe="300">
    <decoded>
      <match>MME</match>
    </decoded>
    <match>Initial UE Message|EUTRAN_CGI</match>
    <regex>(null|NULL|segfault|Segmentation fault|crash|abort|decode error)</regex>
    <description>Magma MME: possible NULL pointer dereference / crash in S1AP Initial UE Message handling (CVE-2023-37033)</description>
    <group>attempted_dos,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
    <cve>CVE-2023-37033</cve>
  </rule>
</group>

Note: For all rule templates, verify the exact log paths, sourcetypes, and process names against your Magma deployment before production deployment. The provided rules emphasize the vulnerability's detection at both the network layer (S1AP/SCTP anomalies) and host layer (MME crash events).

Mitigation & Patch Guidance

Patch confidence for this CVE is 0/4 — UNPATCHED in the tracked source data, meaning no patch evidence was corroborated from tracked patch sources at the time of analysis. Notably, the NVD description itself references a fix in Magma v1.9 at commit 08472ba98b8321f802e95f5622fa90fec2dea486. This discrepancy should be resolved by directly validating the upstream commit and official Magma release notes.

1. Immediate mitigations (no patch verified):

   • Restrict network access to the S1-MME interface (SCTP/S1AP) to only known, authenticated eNodeB IP addresses or subnets using firewall/ACL rules on the MME host and at the network edge.
   • Segment the transport network so the S1-MME interface is not reachable from untrusted or lower-trust segments; treat the core network as a high-trust zone.
   • Where possible, enable SCTP-level access control (whitelisting of peer IPs) and monitor for new or unexpected SCTP associations on the S1AP port.
   • Deploy MME process supervision/auto-restart with crash-loop protection — but note that auto-restart alone does not stop the attack, it only shortens the outage window; combine with rate-limiting or fail-safe blocking of repeat traffic from the same source.

2. Patch / upgrade steps:

   • Validate the referenced fix: review Magma v1.9 and commit 08472ba98b8321f802e95f5622fa90fec2dea486 from the official Magma repository (github.com/magma/magma) to confirm the EUTRAN_CGI presence check is added to the S1AP Initial UE Message handler.
   • Upgrade the MME (and dependent Magma components) to a version including the fix (>= v1.9, per the NVD description). Test the upgrade in a staging environment that mirrors production S1AP traffic, including malformed-input regression tests.
   • Subscribe to Magma security advisories and release notes to correlate the upstream fix with an official CVE advisory if and when one is published.

3. Long-term hardening:

   • Add input-validation and fuzz-testing coverage for the S1AP ASN.1 PER decoder and MME message handlers; an automated fuzzing pipeline (e.g., protocol fuzzing of S1AP PDUs) would have identified this NULL dereference in CI.
   • Architect MME redundancy (N+M or active/standby) so a single MME crash does not cause a service-area-wide outage; ensure S1-flex load-balancing across multiple MMEs.
   • Harden the S1-MME control plane with mutual authentication where the RAN/core interfaces support it (e.g., IPsec/DTLS protection of S1AP), and enforce strict peer validation.
   • Implement continuous monitoring and alerting for S1AP decode errors, NULL-pointer crashes, and process restarts, using rules such as those provided in the Detection Guidance section.

References

1. NVD — CVE-2023-37033: https://nvd.nist.gov/vuln/detail/CVE-2023-37033
2. MITRE CVE Record — CVE-2023-37033: https://www.cve.org/CVERecord?id=CVE-2023-37033
3. Magma Project — Official Repository and Release Notes (fix referenced at commit 08472ba98b8321f802e95f5622fa90fec2dea486): https://github.com/magma/magma
4. FIRST EPSS — CVE-2023-37033 score data (EPSS 0.00373, 30.5th percentile): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2023-37033 is NOT listed (KEV status: NO): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor campaign / in-the-wild evidence: None identified in the available data. CISA KEV does not list this CVE, no public exploit code or Nuclei template exists, and the low EPSS percentile suggests no active mass exploitation as of the analysis date. The primary risk remains targeted denial-of-service attacks by network-adjacent adversaries against telecom operators and private LTE/5G networks running Magma <= 1.8.0.