CVE-2023-37030

Name of the Vulnerable Software and Affected Versions Magma versions 1.8.0 and earlier

Description A null pointer dereference issue in the Mobile Management Entity (MME) allows network-adjacent attackers to crash the MME via an S1AP "Initial UE Message" packet missing an expected eNB UE S1AP ID field.

Recommendations For Magma versions 1.8.0 and earlier, update to version 1.9 or later, specifically including commit 08472ba98b8321f802e95f5622fa90fec2dea486, to resolve the issue. As a temporary workaround, consider restricting access to the S1AP "Initial UE Message" packet to minimize the risk of exploitation.