Open5GS MME up to 2.6.4 S1AP Packet MME_UE_S1AP_ID denial of service

Summaryinfo

A vulnerability marked as problematic has been reported in Open5GS MME up to 2.6.4. This impacts an unknown function of the component S1AP Packet Handler. The manipulation of the argument MME_UE_S1AP_ID leads to denial of service. This vulnerability is documented as CVE-2023-37011. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Open5GS MME up to 2.6.4. This issue affects an unknown code of the component S1AP Packet Handler. The manipulation of the argument MME_UE_S1AP_ID with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `Handover Required` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.

The advisory is shared at cellularsecurity.org. The identification of this vulnerability is CVE-2023-37011 since 06/28/2023. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Open5GS

Name

• MME

Version

• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion