CVE-2023-37035

Executive Summary

CVE-2023-37035 is a null-pointer dereference vulnerability in the Mobile Management Entity (MME) of Magma, an open-source LTE/5G core network platform, affecting versions up to and including v1.8.0. A network-adjacent attacker can crash the MME by transmitting a crafted S1AP S1Setup Request message that omits the mandatory Global eNB ID field. Successful exploitation causes a denial of service on the mobile core signaling plane, disrupting UE attach, handover, and paging procedures for all eNodeBs served by the affected MME. No CVSS vector is published, the CVE is not listed in CISA KEV, and no public exploit code is known at the time of writing.

Technical Analysis

Magma is a Linux Foundation–hosted open-source project that provides a mobile core network (EPC/5G core). Within that architecture, the MME is the control-plane element responsible for mobility management: it terminates S1-MME signaling from eNodeBs, handles UE authentication, attach, tracking-area updates, and handovers. Signaling between the eNodeB (RAN) and the MME is carried by the S1 Application Protocol (S1AP), transported over SCTP on the S1-MME interface (standard port 36412).

The S1AP S1Setup procedure is the first message an eNodeB sends when it establishes a connection to the MME. Per the 3GPP S1AP specification (TS 36.413), the S1Setup Request is expected to carry a set of information elements (IEs), including the Global eNB ID, which identifies the sending base station. In Magma ≤ 1.8.0, the MME's S1AP message parser does not robustly handle the case where this expected IE is absent. The NVD description indicates that a malformed S1Setup Request missing the Global eNB ID field triggers a null-pointer dereference in the MME. The insufficient technical detail in the CVE record means the vulnerable function name and exact code path are not publicly disclosed; the issue class is CWE-476 (NULL Pointer Dereference).

The attack surface is the S1-MME control-plane interface, which is reachable by any host that can send SCTP packets to the MME's S1AP listener — hence the "network-adjacent" attacker positioning in the NVD description. Because S1Setup is an unauthenticated, connection-initiating procedure, no prior authentication or session establishment is required. A single malformed message is sufficient to trigger the dereference and crash the MME process, making the vulnerability trivially repeatable. The fix referenced in the NVD description is the Magma v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486, which presumably adds a null-check or input validation for the missing IE before dereferencing. Notably, the aggregated patch confidence is 0/4 and no patch sources are populated, so defenders should not assume the fix is distributed through standard update channels; the referenced commit must be manually verified in the deployment's source tree.

Exploitation Scenarios

No public proof-of-concept or exploit code has been identified for CVE-2023-37035 (POC_STATUS: Unknown). The attack chain below is therefore inferred from the vulnerability class (null-pointer dereference in an S1AP parser) and from the S1AP protocol flow, strictly based on the NVD description. These steps are a reconstruction, not a confirmed exploit.

1. Reconnaissance & target identification: The attacker is network-adjacent, meaning they already have access to a network segment that can route SCTP traffic toward the MME (e.g., the operator's RAN transport network, or a segment where a rogue eNodeB can be attached). The attacker scans for SCTP listeners on port 36412 (standard S1-MME) to identify the MME endpoint. Network-adjacent attackers may also passively observe SCTP INIT/INIT-ACK exchanges to fingerprint the MME.

2. Triggering the flaw: The attacker opens an SCTP association to the MME's S1AP listener and sends an S1AP S1Setup Request message in which the Global eNB ID information element is omitted. No exploit payload is required — the flaw is triggered purely by the structural absence of an expected mandatory IE. Because S1Setup is an unauthenticated initiation procedure, the malformed message is accepted by the MME's parser and processed.

3. Payload/execution method at the class level: At the vulnerability-class level, the parser retrieves the Global eNB ID field, receives a null pointer (or equivalent uninitialized value) because the IE is absent, and subsequently dereferences that pointer without a validity check (CWE-476). The result is a segmentation fault / process crash. No memory-corruption, code-execution, or privilege-escalation mechanism is indicated by the CVE description; the impact is entirely on availability.

4. Post-exploitation impact: The MME process crashes, taking down S1AP signaling for all eNodeBs attached to that MME. UEs already registered lose mobility management services (handover, paging, tracking-area updates), and new UEs can no longer attach. If the MME is configured to auto-restart, the attacker can replay the malformed message in a crash-loop pattern, creating a persistent denial of service against the mobile core.

Impact Assessment

The primary impact is a denial of service against the MME, which is a single point of failure for the EPC control plane. The blast radius extends beyond the MME process itself: every eNodeB connected to the affected MME and every UE camped on those eNodeBs is affected. Consequences include failed UE attach attempts, dropped handovers for in-motion subscribers, failed paging (incoming calls/SMS not delivered), and potential loss of emergency-call routing. Availability is the only impacted security property; the NVD description gives no indication of confidentiality or integrity impact, and no code-execution or data-exfiltration path is implied.

No CVSS score or vector is published for this CVE, so no CVSS subscore breakdown is available. The EPSS score is 0.00248 (16.4th percentile of actively exploited CVEs), indicating a low current likelihood of exploitation in the wild — consistent with the absence of public PoC/exploit code and the absence of a CISA KEV listing. However, the technical simplicity of the trigger (one malformed signaling message, no authentication) elevates the threat should the technique become public. For operators of Magma-based core networks, this is a high-severity availability risk despite the low CVSS/EPSS data, because the vulnerable component is network-exposed on the S1-MME interface.

Detection Guidance

Because no public exploit exists and the CVE data is sparse, the following detection content targets the vulnerability class: anomalous S1AP S1Setup Request traffic on the S1-MME interface (SCTP port 36412) that lacks the Global eNB ID IE. Byte-level signatures in the YARA and Suricata rules are heuristics based on the S1AP procedure described and MUST be validated against your own packet captures before production deployment.

Sigma Rule

title: Magma MME S1AP S1Setup Request Missing Global eNB ID
id: c2e0a5f1-3703-5b35-9a00-0000cve37035
status: experimental
description: Detects S1AP S1Setup Request messages on the S1-MME interface (SCTP 36412) that lack the mandatory Global eNB ID information element, the trigger condition for CVE-2023-37035 (null pointer dereference in Magma MME <= 1.8.0).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37035
author: Valters IT Threat Intelligence
date: 2025/01/01
logsource:
    category: network-connection
    product: zeek
detection:
    selection:
        destination.port: 36412
        network.transport: sctp
    anomaly:
        s1ap.procedure: S1Setup
        s1ap.global_enb_id: absent
    condition: selection and anomaly
falsepositives:
    - Faulty or non-conformant eNodeB firmware sending malformed S1Setup messages
    - Lab environments with synthetic S1AP test generators
level: high

YARA Rule

rule CVE_2023_37035_Magma_MME_S1AP_No_Global_eNB_ID
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Heuristic detection of PCAPs containing S1AP S1Setup Request messages that omit the Global eNB ID information element (CVE-2023-37035). Byte patterns are illustrative heuristics based on 3GPP TS 36.413 and MUST be validated against local S1AP captures."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-37035"
        cve = "2023-37035"
        date = "2025-01-01"
    strings:
        // S1AP InitiatingMessage with procedureCode 1 (S1Setup) - heuristic prefix
        $s1ap_s1setup = { 00 00 01 00 }
        // SCTP Payload Protocol Identifier 18 = S1AP (Network byte order)
        $sctp_ppid_s1ap = { 00 00 00 12 }
        // Heuristic marker for the Global eNB ID IE in S1AP (tune per capture)
        $glob_enb_id_ie = { 00 42 }
    condition:
        // PCAP (little-endian magic) or pcapng (0x0A0D0D0A)
        (uint16(0) == 0xa1b2 or uint32(0) == 0x0a0d0d0a)
        and $sctp_ppid_s1ap
        and $s1ap_s1setup
        and not $glob_enb_id_ie
}

Suricata IDS Rule

alert sctp any any -> any 36412 (msg:"ET EXPLOIT Magma MME S1AP S1Setup Request Missing Global eNB ID (CVE-2023-37035)"; flow:to_server; content:"|00 00 00 12|"; content:"|00 00 01 00|"; depth:4; sid:202337035; rev:1; metadata:created_at 2025_01_01, updated_at 2025_01_01, signature_severity Major;)

Note: This rule relies on the standard S1-MME port 36412 and on heuristic byte patterns for the S1AP S1Setup procedure. Operators using non-standard S1AP ports must adjust the rule. Absence of the Global eNB ID IE is inferred when the message matches the S1Setup procedure prefix; deeper inspection can be added via a custom Lua script that parses S1AP IE presence.

Elastic Detection

// Alert-driven correlation on Suricata/Zeek telemetry (responds to the signature above)
any where event.module == "suricata" and suricata.eve.alert.signature_id == 202337035

// Raw telemetry layer: flag S1AP signaling contacts toward the MME for further review
network where network.transport == "sctp" and destination.port == 36412 and event.category == "network"

The second query is deliberately broad; analysts should combine it with a threshold/correlation rule that flags repeated S1Setup attempts from a single source without successful registration, which is consistent with crash-loop exploitation. EQL does not natively express "absence of an IE" in payload data, so payload-level detection should be delegated to the Suricata rule.

Splunk SPL Query

index=suricata dest_port=36412 proto=sctp
| search "S1Setup" OR "S1AP"
| where isnull(glob_enb_id) OR NOT match(_raw, "Global eNB ID")
| table _time, src_ip, dest_ip, dest_port, alert_signature, _raw
| sort - _time

If Zeek S1AP metadata (e.g., s1ap.procedure) is indexed, add:

index=zeek dest_port=36412
| where s1ap_procedure=="S1Setup" AND isnull(s1ap_global_enb_id)
| table _time, id.orig_h, id.resp_h, s1ap_procedure

Wazuh OSSEC Rule

<group name="magma,">
  <rule id="100370" level="12">
    <decoded>
      <type>.+</type>
    </decoded>
    <field name="alert.signature">CVE-2023-37035</field>
    <description>Magma MME S1AP S1Setup Request missing Global eNB ID (CVE-2023-37035) - potential MME crash attempt</description>
    <group>network,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for this CVE is 0/4 — no tracked patch source confirms an available fix, despite the NVD description citing the v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486. Defenders should treat the fix as unverified until it is confirmed present in their specific Magma build.

1. Immediate mitigations:

   • Restrict network access to the MME's S1AP listener (SCTP 36412) to only trusted eNodeB/transport IP ranges using firewall/ACL rules. The "network-adjacent" attack vector is neutralized if untrusted segments cannot reach the S1-MME interface.
   • If SCTP 36412 must be exposed, deploy the Suricata rule above in blocking mode, and configure watchdog/auto-restart limits on the MME to prevent crash-loop persistence.
   • Monitor SCTP associations toward the MME for unusual S1Setup initiations; alert on repeated malformed S1Setup attempts.

2. Patch/upgrade steps:

   • Upgrade Magma MME to v1.9 or later per the NVD description. Verify that the source tree actually contains commit 08472ba98b8321f802e95f5622fa90fec2dea486 (e.g., git show <hash> or git merge-base --is-ancestor <hash> HEAD).
   • If you cannot upgrade immediately, review the MME S1AP parser code path that processes the Global eNB ID field and add a null/absence check as a local hotfix in your build pipeline.
   • Re-test S1Setup handling with an S1AP fuzzer (e.g., malformed/missing IE cases) after patching to confirm the crash is resolved.

3. Long-term hardening:

   • Place the S1-MME interface on a dedicated, isolated transport VLAN/network segment with strict SCTP peer authentication where supported.
   • Integrate S1AP parser fuzzing into your CI/CD pipeline for Magma and related core components; CWE-476 defects commonly recur in protocol parsers.
   • Maintain network-layer visibility (Suricata/Zeek) on the S1-MME interface and route alerts to the SOC for continuous monitoring of signaling-plane anomalies.

References

• NVD entry: CVE-2023-37035 — https://nvd.nist.gov/vuln/detail/CVE-2023-37035
• Magma project: https://magmacore.org/ (open-source mobile core; MME component subject of this CVE)
• Fix reference (per NVD description): Magma v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 — https://github.com/magma/magma/commit/08472ba98b8321f802e95f5622fa90fec2dea486
• CWE-476 NULL Pointer Dereference: https://cwe.mitre.org/data/definitions/476.html
• CISA KEV: CVE-2023-37035 is NOT listed (catalog.cisa.gov) — no known in-the-wild exploitation. No threat-actor campaigns or exploit-in-the-wild evidence are documented for this CVE at the time of writing.