CVE-2023-37031: 
NixOS vulnerability analysis and mitigation

A Null pointer dereference vulnerability exists in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486). The vulnerability allows network-adjacent attackers to crash the MME via an S1AP eNB Configuration Transfer packet missing its required Target eNB ID field (NVD, Cellular Security).

The vulnerability is classified as a NULL pointer dereference issue with a CVSS v3.1 base score of 6.5 MEDIUM (Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue occurs when processing S1AP eNB Configuration Transfer packets that are missing the required Target eNB ID field, leading to a null pointer being dereferenced and causing the MME to crash (NVD).

When exploited, this vulnerability allows attackers to crash the Mobile Management Entity (MME), resulting in a denial of service that affects cellular communications at a city-wide level. The disruption could persist until network operators identify and patch the vulnerability (Cellular Security).

The vulnerability can be exploited by network-adjacent attackers without requiring authentication (no SIM card needed). The attack can be executed by sending malformed S1AP packets at the beginning of a cellular connection. With the widespread deployment of Wi-Fi Calling services, these attacks can potentially be executed by any entity on the Internet by sending a few packets (Cellular Security).

The vulnerability has been fixed in Magma v1.9 with commit 08472ba98b8321f802e95f5622fa90fec2dea486. Organizations running affected versions should upgrade to the patched version (NVD).