CVE-2023-37008: Buffer Overflow
Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causes type confusion in decoded fields, leading to invalid parsing and freeing of memory. An attacker may use this to crash an MME or potentially execute code in certain circumstances.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-37008?
CVE-2023-37008 is classified with high severity due to its potential for remote code execution and service disruption.
How do I fix CVE-2023-37008?
To fix CVE-2023-37008, it is recommended to upgrade Open5GS MME to version 2.6.5 or higher where the vulnerability has been addressed.
What causes the vulnerability CVE-2023-37008?
CVE-2023-37008 is caused by a buffer overflow in the ASN.1 deserialization function of the S1AP handler.
What are the potential impacts of CVE-2023-37008?
The potential impacts of CVE-2023-37008 include crashing the MME service or executing arbitrary code.
Which versions of Open5GS MME are affected by CVE-2023-37008?
Open5GS MME versions 2.6.4 and below are affected by CVE-2023-37008.