CVE-2023-37032

A Stack-based buffer overflow in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows remote attackers to crash the MME with an unauthenticated cellphone by sending a NAS packet containing an oversized `Emergency Number List` Information Element.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cellularsecurity.org/ransacked	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:magma:*:*:*:*:*:*:*:*

History

13 Mar 2025, 15:15

Type	Values Removed	Values Added
CWE		CWE-78

18 Feb 2025, 21:15

Type	Values Removed	Values Added
CWE	~~CWE-120~~

27 Jan 2025, 14:34

Type	Values Removed	Values Added
CWE		CWE-787
First Time		Linuxfoundation Linuxfoundation magma
References	~~() https://cellularsecurity.org/ransacked -~~	() https://cellularsecurity.org/ransacked - Exploit, Third Party Advisory
CPE		cpe:2.3:a:linuxfoundation:magma::::::::

23 Jan 2025, 16:15

Type	Values Removed	Values Added
CWE		CWE-120
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
Summary		(es) Un desbordamiento de búfer basado en pila en la entidad de administración móvil (MME) de las versiones de Magma <= 1.8.0 (corregido en v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) permite a atacantes remotos bloquear la MME con un teléfono celular no autenticado mediante el envío de un paquete NAS que contiene un elemento de información de "Lista de números de emergencia" de gran tamaño.

21 Jan 2025, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-21 23:15

Updated : 2025-03-13 15:15

NVD link : CVE-2023-37032

Mitre link : CVE-2023-37032

CVE.ORG link : CVE-2023-37032

JSON object : View

Products Affected

linuxfoundation

magma

CWE

CWE-787

Out-of-bounds Write

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2023-37032", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-01-21T23:15:10.473", "references": [{"url": "https://cellularsecurity.org/ransacked", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A Stack-based buffer overflow in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows remote attackers to crash the MME with an unauthenticated cellphone by sending a NAS packet containing an oversized `Emergency Number List` Information Element."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer basado en pila en la entidad de administraci\u00f3n m\u00f3vil (MME) de las versiones de Magma <= 1.8.0 (corregido en v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) permite a atacantes remotos bloquear la MME con un tel\u00e9fono celular no autenticado mediante el env\u00edo de un paquete NAS que contiene un elemento de informaci\u00f3n de \"Lista de n\u00fameros de emergencia\" de gran tama\u00f1o."}], "lastModified": "2025-03-13T15:15:38.560", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:magma:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8A5EBCA-655B-4F9A-BE55-E53485D8EEE4", "versionEndIncluding": "1.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}