PT-2025-1425 · Magma · Magma

Publicado 2025-01-21 · Atualizado 2025-01-22 · CVE-2023-37033

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Magma versions 1.8.0 and earlier

Description A null pointer dereference issue in the Mobile Management Entity (MME) allows network-adjacent attackers to crash the MME via an S1AP "Initial UE Message" packet missing an expected EUTRAN CGI field. This issue can be exploited by sending a specially crafted packet, causing the MME to crash.

Recommendations For Magma versions 1.8.0 and earlier, update to version 1.9 or later, which includes the fix for this issue, as committed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486. As a temporary workaround, consider implementing network filtering to block S1AP "Initial UE Message" packets missing the EUTRAN CGI field.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2023-37033

Produtos afetados

Magma

Referências · 4

• 🔥 https://cellularsecurity.org/ransacked · Exploit
• https://twitter.com/CVEnew/status/1881933337717047478 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-37033 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37033 · Aviso do Fabricante