CVE-2023-37036

Executive Summary

CVE-2023-37036 is a null pointer dereference vulnerability in the Mobility Management Entity (MME) of the Magma open-source cellular core network platform, affecting versions up to and including 1.8.0. A network-adjacent attacker able to reach the S1-MME transport segment can crash the MME by sending an S1AP Uplink NAS Transport packet that omits the mandatory ENB_UE_S1AP_ID information element, causing a denial-of-service condition on the LTE control plane. No CVSS vector, CISA KEV listing, or public exploit code has been published for this CVE, and the EPSS score is low (0.00373), but the affected component is control-plane-critical and the impact of even a single crash is significant for subscriber attach, tracking area update, and bearer management functions.

Technical Analysis

Magma is a software-defined networking platform for mobile broadband networks, providing disaggregated LTE/5G core functions that can be deployed on commodity hardware. Within the Magma architecture, the MME (Mobile Management Entity) is the LTE control-plane node responsible for UE authentication, attach procedures, tracking area updates, handover signaling, and establishment of default and dedicated bearers. The MME communicates with eNodeBs over the S1-MME interface, which is implemented using the S1 Application Protocol (S1AP) carried over SCTP.

The vulnerability class is a null pointer dereference. When the MME's S1AP protocol parser receives an Uplink NAS Transport message, it logically expects certain information elements to be present to associate the message with an existing UE context. The ENB_UE_S1AP_ID field is a numeric identifier assigned by the eNodeB that allows the MME to uniquely identify the S1 association for a given UE. If a crafted packet on this procedure type omits that field and the parser proceeds to dereference the parsed structure without first validating presence, the code path dereferences a null pointer, resulting in a segmentation fault and termination of the MME process.

No additional code-level details — such as the specific parsing function, validation routine, or memory layout — are disclosed in the NVD description. The analysis is therefore strictly at the mechanism level: an unvalidated mandatory IE in an S1AP PDU triggers a null pointer dereference. The attack surface is the S1-MME interface itself, which in production is typically confined to a dedicated backhaul/transport network connecting eNodeBs to the core. However, Magma deployments often operate in more open environments — lab networks, edge PoCs, neutral-host arrangements, or multi-tenant RAN sharing — where the network-adjacent trust boundary is weaker and an attacker may be able to inject SCTP traffic toward the MME endpoint.

The NVD description indicates the flaw is fixed in Magma v1.9, referencing commit 08472ba98b8321f802e95f5622fa90fec2dea486. Importantly, the patch-tracking confidence for this report is 0/4, meaning the tracked patch sources report no verified patch evidence and the vendor has not published an advisory. The commit referenced in the NVD description should be treated as the authoritative fix location, but organizations should verify the commit content directly in their source tree before relying on it.

Exploitation Scenarios

No public proof-of-concept or exploit code is known for CVE-2023-37036. The attack chain below is inferred from the vulnerability class and the protocol mechanics described in the NVD entry, and should be treated as an analyst-derived scenario rather than a confirmed exploit.

1. Reconnaissance / target identification: An attacker positioned on a network segment adjacent to the MME — such as the RAN backhaul, a compromised eNodeB, or a shared transport network — first identifies the MME's S1-MME SCTP listening endpoint. Standard site reconnaissance techniques for this protocol stack include SCTP port scanning (the well-known S1-MME port is 36412), passive enumeration of SCTP INIT-ACK responses, or observing prior eNodeB-to-MME associations. Because the attacker is network-adjacent, IP spoofing of a legitimate eNodeB address may also be feasible if ingress filtering is weak.

2. Triggering the flaw: The attacker crafts an S1AP Uplink NAS Transport packet designed to be accepted by the MME's S1AP parser. The packet is deliberately missing the ENB_UE_S1AP_ID information element that the MME's message handling logic expects for this procedure. The packet can be embedded in an SCTP DATA chunk and delivered within an established S1AP association, or injected as new association traffic if the MME does not strictly validate the eNodeB source address. When the parser passes a null reference to the processing function that reads the UE S1AP ID, the MME process crashes.

3. Payload / execution method at the class level: The vulnerability is triggered by a malformed protocol message rather than injected code. No memory corruption or code execution is required — the null pointer dereference is itself the crash primitive. The attacker repeats the packet transmission as needed, either manually or with a simple script, turning a single crash into an availability attack. Because the MME may automatically restart or be restarted by a supervisor process, the attacker can re-trigger the crash in a loop to sustain denial of service.

4. Post-exploitation impact: Each crash of the MME interrupts all control-plane services for every UE registered with that MME instance. New attach requests fail, tracking area updates are not processed, and in-progress signaling for handovers or bearer modifications is dropped. If the MME holds state in memory that is not persisted, a crash may also clear existing UE contexts, forcing mass re-attach when the process returns — a behavior known as an attach storm. The attacker does not gain data access, privilege escalation, or persistence through this vulnerability; the impact is strictly availability, but at the scale of the entire served network cell population.

Impact Assessment

The primary business impact is denial of service against the LTE control plane. A network-adjacent attacker who can deliver the malformed S1AP message can single-handedly take down the MME, affecting every subscriber attached to the eNodeBs served by that MME. In mobile network operations, MME downtime translates directly to customer-visible failures: failed attaches, dropped signaling, no handover support, and prolonged service outage during recovery. For enterprises operating private LTE/5G networks on Magma — such as industrial campuses, edge data centers, or rural ISP deployments — this represents a critical availability risk to operational workflows that depend on continuous wireless connectivity.

The blast radius is limited in one respect: the vulnerability is not remotely exploitable over the public internet in typical architectures because the S1-MME interface is normally isolated on transport networks. The MME is not directly exposed to the internet, and the CVSS vector is listed as N/A, so no standardized severity subscores are available. The EPSS score of 0.00373 places this CVE in roughly the 30.5th percentile of exploited CVEs, consistent with low current exploit activity in the wild. However, because Magma is frequently deployed in smaller and less mature network environments with weaker segmentation, the practical likelihood of a network-adjacent attacker reaching the S1-MME segment should be assessed per deployment. The crash is a single-threaded process termination; there is no evidence of memory corruption beyond the null dereference, so confidentiality and integrity impact are assessed as none, with the entire impact concentrated in availability.

Detection Guidance

Given that no public exploit code is available and the vulnerability manifests as a protocol-parser failure, detection must combine network-layer anomaly monitoring with host-level crash and service-restart telemetry. The rules below are realistic detection signatures aligned to the S1AP protocol fields disclosed in the NVD description. They are intended for SOC teams to adapt to their local logging sources.

Sigma Rule

title: Magma MME Crash Indicators for CVE-2023-37036
id: 9f7a1c3e-5b62-4d81-a93f-2d1c48e7f0a1
status: experimental
description: >
  Detects MME process crash or S1AP parser error events referencing the
  Uplink NAS Transport procedure and the ENB_UE_S1AP_ID field, consistent
  with a null pointer dereference attempt (CVE-2023-37036).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-37036
author: Valters IT Cyber Intelligence
date: 2025/04/23
logsource:
  product: linux
  service: syslog
detection:
  selection_crash:
    message|contains:
      - 'segfault'
      - 'null pointer'
      - 'SIGSEGV'
      - 'core dumped'
  selection_mme_context:
    message|contains|all:
      - 'MME'
      - 'S1AP'
      - 'Uplink NAS Transport'
      - 'ENB_UE_S1AP_ID'
  condition: selection_crash and selection_mme_context
falsepositives:
  - Legitimate telemetry logs during protocol stack upgrades or testing
  - Generic Linux crash logs unrelated to the MME process
level: high

YARA Rule

/*
   YARA rule for CVE-2023-37036
   Targets packet capture files, hex dumps, and attacker tooling
   that reference the S1AP Uplink NAS Transport procedure and the
   ENB_UE_S1AP_ID field. The exact on-wire S1AP encoding is not
   disclosed in the NVD description, so this rule focuses on
   textual/artifact indicators rather than specific bytes.
*/
rule CVE_2023_37036_S1AP_UplinkNAS_Missing_UE_ID
{
    meta:
        author = "Valters IT Cyber Intelligence"
        description = "Detects artifacts referencing S1AP Uplink NAS Transport and ENB_UE_S1AP_ID for CVE-2023-37036"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-37036"
        date = "2025-04-23"
        cve = "CVE-2023-37036"

    strings:
        $a = "ENB_UE_S1AP_ID" ascii wide
        $b = "Uplink NAS Transport" ascii wide
        $c = "UplinkNASTransport" ascii wide
        $d = "CVE-2023-37036" ascii wide
        $e = "S1AP" ascii wide
        $f = "MME crash" ascii wide

        // PCAP magic (little-endian) for pcap-targeted detection
        $pcap_le = { D4 C3 B2 A1 }
        $pcap_be = { A1 B2 C3 D4 }

    condition:
        uint16(0) == 0x4D5A or uint32(0) == 0x7F454C46 or
        $pcap_le at 0 or $pcap_be at 0 or
        (2 of ($a, $b, $c, $d, $f) and 1 of ($e, $a)) or
        (1 of ($a, $b, $c, $d) and filesize < 10MB)
}

Suricata IDS Rule

# CVE-2023-37036 - Magma MME S1AP Uplink NAS Transport anomaly
# The missing-IE condition cannot be expressed purely in signature
# content without the exact S1AP encoding. This rule detects
# SCTP traffic toward the S1-MME port combined with S1AP
# application-layer events and bursts that are consistent with
# repeated crash-trigger attempts. Tune the threshold to the
# observed baseline of the monitored network.
alert sctp any any -> any 36412 (msg:"CVE-2023-37036 Potential S1AP Uplink NAS Transport DoS trigger against Magma MME"; app-layer-protocol:s1ap; flow:established,to_server; threshold:type both, track by_src, count 25, seconds 60; sid:2023703601; rev:1;)

# Coarse signature for SCTP probes toward the S1-MME service port
alert sctp any any -> any 36412 (msg:"CVE-2023-37036 SCTP probe toward possible Magma MME S1-MME endpoint"; app-layer-protocol:s1ap; flow:to_server,no_established; sid:2023703602; rev:1;)

Elastic Detection

// Elastic EQL: correlate S1AP/SCTP traffic anomalies with MME process termination.
// Adjust process.name wildcard to the actual Magma MME service binary in your environment.

sequence by host.name with maxspan=5m
  [ network where network.protocol == "sctp" and destination.port == 36412 ]
  [ process where event.action in ("crash", "end", "stop", "terminated") and process.name == "*mme*" ]

Splunk SPL Query

index=* (sourcetype="*mme*" OR sourcetype="syslog" OR sourcetype="*sctp*")
  ("S1AP" OR "s1ap")
  ("Uplink NAS Transport" OR "uplink_nas" OR "ULNAS")
  ("ENB_UE_S1AP_ID" OR "null" OR "segfault" OR "SIGSEGV" OR "crash")
| eval indicator = case(
    match(_raw, "(?i)(null pointer|segfault|SIGSEGV|core dumped)"), "MME_CRASH",
    match(_raw, "(?i)(uplink nas transport)"), "S1AP_ANOMALY",
    true(), "CORRELATION")
| stats count by host, source, indicator, _time
| sort - _time
| where count > 5

Wazuh OSSEC Rule

<group name="magma, s1ap,">
  <rule id="100336" level="12">
    <decoded_as>syslog</decoded_as>
    <field name="program">.*mme.*</field>
    <match>S1AP|Uplink NAS Transport|ENB_UE_S1AP_ID</match>
    <regex>\b(null pointer|segfault|SIGSEGV|core dumped)\b</regex>
    <description>CVE-2023-37036 indicator: Magma MME crash event involving S1AP Uplink NAS Transport missing ENB_UE_S1AP_ID.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve-2023-37036,</group>
  </rule>

  <rule id="100337" level="8">
    <decoded_as>syslog</decoded_as>
    <match>S1AP.*Uplink NAS Transport</match>
    <description>CVE-2023-37036 related S1AP Uplink NAS Transport traffic seen; possible reconnaissance or trigger attempts.</description>
    <group>cve-2023-37036,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for this CVE is 0/4 from tracked sources, meaning no vendor advisory or verified patch is currently registered in the tracking data. The NVD description itself references a fixed commit — 08472ba98b8321f802e95f5622fa90fec2dea486 in Magma v1.9 — but this has not been corroborated by independent patch-tracking sources. Until the fix is verified, treat affected Magma deployments as unpatched.

1. Immediate mitigations: Restrict network-level access to the S1-MME interface and the MME SCTP endpoint using firewall rules and access control lists; allow only known eNodeB source addresses. If the deployment uses IPsec or TLS transport for S1AP, ensure it is enabled and that keys for RAN elements are strictly managed. Monitor MME process health with an auto-restart supervisor to minimize downtime from a single crash. If the environment is a lab or PoC, isolate it from any shared or untrusted transport networks.

2. Patch / upgrade steps: Obtain the Magma source tree and inspect commit 08472ba98b8321f802e95f5622fa90fec2dea486 to confirm it validates the presence of ENB_UE_S1AP_ID before dereferencing in the S1AP Uplink NAS Transport handling path. Upgrade the MME component to Magma v1.9 or later once the commit is validated. If a binary distribution is used instead of source-built images, contact the distribution maintainer to confirm the fix is included. After upgrade, regression-test attach, tracking area update, and handover procedures with a test eNodeB that intentionally omits optional IEs to confirm the parser no longer crashes.

3. Long-term hardening: Segment the RAN transport from other network zones using VLANs or separate VRFs, and deploy an SCTP-aware IDS or firewall that can inspect S1AP and flag malformed PDUs. Implement protocol fuzzing of the S1AP parser in a CI pipeline so that similar missing-IE defects are caught before release. Subscribe to Magma security advisories and CVE feeds for the project, and consider contributing any observed crash artifacts back to the maintainers. Finally, ensure MME crash logs are shipped to a central SIEM so that the detection rules above can operate continuously.

References

• NVD Entry for CVE-2023-37036: https://nvd.nist.gov/vuln/detail/CVE-2023-37036
• Magma project (official site and source repository): https://magmacore.org
• FIRST EPSS score lookup for CVE-2023-37036: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (negative listing confirmation — CVE-2023-37036 is NOT on KEV): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Magma source fix reference: commit 08472ba98b8321f802e95f5622fa90fec2dea486 (Magma v1.9) — as cited in the NVD description

No known threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2023-37036. Organizations should continue to monitor public exploit databases and the Magma advisory channels for updates to the patch status.