CVE-2023-37038

Executive Summary

CVE-2023-37038 is a null pointer dereference vulnerability in the Mobile Management Entity (MME) component of Magma, an open-source mobile core network platform. Magma versions up to and including 1.8.0 are affected; a network-adjacent attacker can crash the MME by sending a single malformed S1AP Uplink NAS Transport packet that omits the mandatory MME_UE_S1AP_ID field. The resulting denial of service (DoS) disrupts mobility management for all subscribers served by that MME instance, and the issue is addressed in Magma v1.9. No public exploit code, active exploitation evidence, or CISA KEV listing was identified at the time of writing.

Technical Analysis

The Magma MME is a control-plane network function in the evolved packet core (EPC) and 5G core stack. It terminates the S1AP protocol (3GPP TS 36.413) on the S1 interface between eNodeBs (base stations) and the core network. S1AP signaling is transported over SCTP, and the MME processes messages such as initial UE attach, tracking area updates, paging, and handover signaling.

The vulnerable message type is Uplink NAS Transport, which the eNodeB sends to the MME to relay a non-access stratum (NAS) message (e.g., attach request, service request) from a user equipment (UE) to the core network. Per the S1AP specification, the Uplink NAS Transport message must carry the MME_UE_S1AP_ID information element (IE), which identifies the UE's S1AP context that was previously established at the MME. When a message arrives without this IE, the MME's message-handling logic attempts to resolve a UE context from a missing/uninitialized value. Because the code path lacks a null check, this results in a null pointer dereference — a classic CWE-476 failure — and crashes the MME process.

The attack surface is the S1 transport network. The NVD description characterizes the attacker as "network-adjacent," meaning the attacker does not need to authenticate as a subscriber or an eNodeB. The trigger is a single crafted packet — no throughput is required. When the MME process crashes, all UEs attached to that MME immediately lose mobility management services, and new attach attempts fail until the process restarts. An attacker who repeats the injection can create a crash/restart loop, effectively pinning the control plane in a permanent denial-of-service state.

The CVE record contains no CNA title, no CVSS vector, and the CWE field is listed as N/A; however, the NVD description explicitly names the failure class as a null pointer dereference, which corresponds to CWE-476. The EPSS score of 0.00373 (30.5th percentile) indicates low current exploitation prevalence in the wild, but DoS vulnerabilities in telecom control-plane functions remain attractive to advanced persistent threat actors given the potential to disrupt regional communications infrastructure.

Exploitation Scenarios

No public PoC is available, so the attack chain is inferred from the vulnerability class and the protocol context described in the NVD record.

1. Reconnaissance / target identification — The attacker identifies an S1AP endpoint (the MME) reachable from an adjacent network segment, such as the S1 transport network between eNodeBs and the core, or a misconfigured management network exposing the MME. Internet-exposed Magma Access Gateway instances discovered via passive scanning of SCTP services could also be viable targets. The attacker may passively observe S1AP traffic to confirm the target is an MME.

2. Triggering the flaw — The attacker constructs a valid S1AP Uplink NAS Transport message but deliberately omits the MME_UE_S1AP_ID information element. Because S1AP is encoded using ASN.1 PER (Packed Encoding Rules), the attacker needs either a modified S1AP encoder or a raw SCTP packet injection tool capable of emitting a PER-encoded message with the mandatory IE stripped. The MME's decoder processes the message without validating the presence of the required IE.

3. Payload / execution method (class level) — The malformed packet is sent toward the MME over SCTP on the S1AP port (IANA-assigned TCP/SCTP port 36412 for S1AP). In the absence of the MME_UE_S1AP_ID, the MME's UE-context lookup routine dereferences a null pointer, causing a segmentation fault. The MME process terminates.

4. Post-exploitation impact — The MME restarts (or fails over, if redundancy is configured). During the outage and restart window, all UEs attached to the MME lose tracking area updates, paging, handover, and attach capabilities. The attacker repeats the injection to maintain a crash/restart loop, resulting in sustained control-plane denial of service. This also degrades emergency-call establishment because the MME is on the mobility management path for all UEs.

Impact Assessment

The primary business impact is availability of the mobile core's control plane. The MME is a central control function; a crash affects every eNodeB and UE served by the specific MME instance, making the blast radius effectively "all subscribers on that network slice or region." There is no direct confidentiality or integrity impact described — the vulnerability is strictly a denial-of-service. The CVSS score is not published (N/A), so no vector string or subscores are available to reference; operational risk should be inferred from the attack surface (network-adjacent, unauthenticated, single-packet trigger) and the criticality of the MME function. The EPSS score of 0.00373 suggests limited immediate in-the-wild exploitation, but this should not be used as a justification to defer patching, since telecom DoS vulnerabilities are frequently weaponized once public analysis appears.

For operators running Magma <= 1.8.0 in production, the risk is elevated because the MME is commonly deployed as a software network function on commodity hardware with automated restart, which an attacker can turn into a self-perpetuating crash loop. Regulatory scrutiny is also possible in jurisdictions where mobile network availability is tied to emergency-services obligations.

Detection Guidance

The rules below assume visibility into (a) MME application logs and process state on the host, and (b) S1-interface network traffic. Log-based detection of process crashes is the most reliable signal because the S1AP payload is ASN.1 PER-encoded, making byte-level network matching difficult without a dedicated S1AP dissector.

Sigma Rule

title: Magma MME Crash - CVE-2023-37038
id: 4f5a3d1c-9c2e-4b8b-a1d6-7e3f0c2a9b5d
status: experimental
description: Detects termination of the Magma MME process, potentially caused by
    a null pointer dereference after processing a malformed S1AP Uplink NAS
    Transport message missing the MME_UE_S1AP_ID IE (CVE-2023-37038).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37038
author: Valters IT Threat Intelligence
date: 2024/05/01
logsource:
    product: linux
    service: sysmon
detection:
    selection:
        EventID: 11
        Image|endswith: '/mme'
    condition: selection
falsepositives:
    - Legitimate MME restart during maintenance windows
    - Memory pressure or OOM-killer termination
level: high
tags:
    - attack.t1499
    - cve.2023-37038

YARA Rule

rule CVE_2023_37038_Magma_MME_S1AP_Exploit_Artifacts
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Hunts for exploit, fuzzer, or PCAP artifacts referencing malformed S1AP Uplink NAS Transport targeting Magma MME (CVE-2023-37038)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-37038"
        date = "2024-05-01"

    strings:
        $s1 = "MME_UE_S1AP_ID" ascii wide
        $s2 = "UplinkNASTransport" ascii wide
        $s3 = "Uplink NAS Transport" ascii wide
        $s4 = "CVE-2023-37038" ascii wide
        $s5 = "Magma" ascii wide
        $pcap  = { d4 c3 b2 a1 }          // pcap little-endian magic
        $pcap2 = { a1 b2 c3 d4 }          // pcap big-endian magic
        $pcapng = { 0a 0d 0d 0a }         // pcapng magic

    condition:
        (1 of ($pcap*) or 1 of ($pcapng*)) and 2 of ($s*)
}

Suricata IDS Rule

S1AP is ASN.1 PER-encoded, so a reliable payload signature requires a protocol-aware S1AP parser. The following rule provides visibility into S1AP control-plane traffic from unexpected sources and should be tuned to the operator's eNodeB allowlist.

alert sctp $EXTERNAL_NET any -> $HOME_NET 36412 (msg:"CVE-2023-37038 Magma MME S1AP DoS - unauthorized S1 control-plane traffic"; flow:to_server; reference:cve,2023-37038; classtype:attempted-dos; sid:2023370381; rev:1;)

Operators with a S1AP-capable decoder should additionally match for a decoded UplinkNASTransport message in which the MME_UE_S1AP_ID IE is absent. Without such a decoder, any single-packet signature would be unreliable because the PER encoding of the message is not human-readable and the absence of an IE cannot be expressed as a fixed byte string.

Elastic Detection

The following EQL rule detects a crash/restart loop of the MME process, the most observable post-exploitation behavior:

sequence by host.name with maxspan=5m
  [ process where event.type == "start" and process.name == "mme" ]
  [ process where event.type == "end" and process.name == "mme" and process.exit_code != 0 ]
  [ process where event.type == "start" and process.name == "mme" ]

For network-level visibility, alert on inbound SCTP traffic to the S1AP port from sources outside the known eNodeB subnets:

network where destination.port == 36412 and network.direction == "inbound"

Splunk SPL Query

The following query searches MME application logs for crash indicators associated with S1AP processing:

index=magma sourcetype=mme*
("UplinkNASTransport" OR "Uplink NAS Transport" OR "S1AP")
AND ("NULL" OR "null pointer" OR "segfault" OR "SIGSEGV" OR "assertion failed")
| stats earliest(_time) as first_seen latest(_time) as last_seen count by host, source, src_ip
| sort - count

For network flow data:

index=netflow (src_port=36412 OR dest_port=36412)
| stats count by src_ip, dest_ip, dest_port
| sort - count

Wazuh OSSEC Rule

<group name="magma,">
    <rule id="100370" level="12">
        <decoded>
        <program_name>^mme$</program_name>
        <match>segfault|SIGSEGV|null pointer|UplinkNASTransport</match>
        <description>Magma MME crash or malformed S1AP Uplink NAS Transport observed - possible CVE-2023-37038 exploitation</description>
        <group>magma,mme,dos,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED per external tracker). The NVD description explicitly states the flaw is fixed in Magma v1.9 at commit 08472ba98b8321f802e95f5622fa90fec2dea486, but no independent patch source confirmed this at the time of analysis. Operators should verify the commit exists in their deployed Magma branch before relying on it as a permanent fix.

1. Immediate mitigations — Restrict network access to the MME's S1AP endpoint; enforce SCTP peer allowlists so only known eNodeBs can establish S1 associations. Isolate the S1 transport network from untrusted segments. Configure MME process supervision (systemd/watchdog) with a restart limit and alerting, so crash-loop behavior is visible. Deploy redundant MME instances with automatic failover where available.

2. Patch / upgrade steps — Upgrade the Magma Access Gateway / MME to v1.9 or later, or cherry-pick commit 08472ba98b8321f802e95f5622fa90fec2dea486 into the current build. After patching, regression-test S1AP attach, tracking area update, and handover procedures, and verify that a malformed Uplink NAS Transport message now generates a protocol error rather than a process crash.

3. Long-term hardening — Add mandatory-IE validation to the S1AP decode path so missing MME_UE_S1AP_ID fields are rejected before context lookup. Introduce fuzzing of S1AP and NAS message handling in CI. Segment the S1 interface onto a dedicated transport network with strict allowlisting. Monitor MME process health, crash logs, and SCTP association anomalies continuously. Track CISA KEV updates in case in-the-wild exploitation is confirmed.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2023-37038
• Magma GitHub repository / fix commit: https://github.com/magma/magma/commit/08472ba98b8321f802e95f5622fa90fec2dea486
• Magma project documentation (MME architecture): https://magma.github.io/magma/docs/lte/overview
• 3GPP TS 36.413 — S1 Application Protocol (S1AP) specification context for the affected message type
• CISA Known Exploited Vulnerabilities catalog: CVE-2023-37038 is not listed (as of this report)

No known threat-actor campaigns or exploit-in-the-wild evidence for CVE-2023-37038 were identified in the provided data or public sources at the time of writing.