CVE-2023-37025: 
NixOS vulnerability analysis and mitigation

A Null pointer dereference vulnerability was discovered in the Mobile Management Entity (MME) in Magma versions 1.8.0 and earlier (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486). The vulnerability affects the core network infrastructure component responsible for mobility management in cellular networks (Cellular Security).

The vulnerability exists in the MME component where a null pointer dereference can occur when processing certain network packets. This issue was discovered as part of a larger security audit that identified over 100 vulnerabilities in various LTE/5G implementations (Cellular Security). The vulnerability has been assigned a CVE identifier CVE-2023-37025.

If exploited, this vulnerability could result in a persistent denial of service affecting cellular communications (phone calls, messaging, and data) at a city-wide level. The impact is particularly severe as cellular networks are considered critical infrastructure for both day-to-day communication and emergency services (Cellular Security).

The vulnerability has been fixed in Magma version 1.9 through commit 08472ba98b8321f802e95f5622fa90fec2dea486. Organizations running affected versions should upgrade to the patched version to mitigate this vulnerability (Cellular Security).