CVE-2024-24420

Executive Summary

CVE-2024-24420 is a reachable assertion vulnerability in the Magma 5G core network software, affecting versions up to and including 1.8.0. The flaw resides in the decode_linked_ti_ie function, which is responsible for decoding NAS (Non-Access Stratum) packets. An attacker can craft a malicious NAS packet that triggers an assertion failure, leading to a Denial of Service (DoS) condition. This vulnerability is particularly concerning for 5G network operators using Magma, as it can be exploited remotely without authentication, potentially disrupting critical network services. The vulnerability has been patched in Magma v1.9, commit 08472ba98b8321f802e95f5622fa90fec2dea486.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned by NVD at this time. However, based on the nature of the vulnerability (remote, unauthenticated DoS), a reasonable estimated CVSS vector would be:

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Estimated Base Score: 7.5 (High)

Breakdown:

• Attack Vector (AV): Network (N) – The attack can be launched remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability due to DoS.

Threat Level: High – The vulnerability is remotely exploitable without authentication and can cause significant service disruption.

Deep Dive & Mechanics

The vulnerability is located in the decode_linked_ti_ie function within the Magma core network's NAS packet processing logic. NAS packets are used for communication between the User Equipment (UE) and the Mobility Management Entity (MME) in 5G networks. The function is responsible for decoding the "Linked TI (Transaction Identifier)" information element from incoming NAS messages.

The issue arises from a reachable assertion. In C/C++ code, assertions are typically used for debugging and sanity checks. When an assertion fails, the program terminates abruptly. In this case, a specially crafted NAS packet can cause the decode_linked_ti_ie function to encounter an unexpected condition, triggering an assert() call. This results in the immediate termination of the MME process, causing a Denial of Service.

The root cause is likely insufficient input validation. The function does not properly check the bounds or validity of the data within the NAS packet before processing it. An attacker can send a malformed NAS packet that contains an invalid or out-of-range value for the Linked TI field, causing the assertion to fire.

Attack Vector:

1. The attacker sends a crafted NAS packet to the Magma MME.
2. The MME receives the packet and passes it to the NAS decoding layer.
3. The decode_linked_ti_ie function is called to parse the Linked TI IE.
4. Due to the malformed data, an assertion condition is met (e.g., a value exceeds an expected range).
5. The assert() macro triggers, causing the MME process to crash.
6. The MME becomes unavailable, disrupting 5G services for all connected UEs.

Vulnerable vs. Patched Code

Vulnerable Code (Magma <= 1.8.0): The vulnerable code likely contains an assertion that is too strict or is placed in a location where it can be triggered by external input. A simplified example:

void decode_linked_ti_ie(uint8_t *data, size_t len) {
    // Assume data[0] is the linked TI value
    uint8_t linked_ti = data[0];
    // Vulnerable assertion: assumes linked_ti is always <= 7
    assert(linked_ti <= 7);
    // ... further processing
}

Patched Code (Magma v1.9, commit 08472ba98b8321f802e95f5622fa90fec2dea486): The patch likely replaces the assertion with proper error handling, such as returning an error code or ignoring the invalid value. A simplified example:

int decode_linked_ti_ie(uint8_t *data, size_t len, uint8_t *output) {
    if (len < 1) {
        return -1; // Error: insufficient data
    }
    uint8_t linked_ti = data[0];
    if (linked_ti > 7) {
        // Log warning and return error instead of asserting
        log_warn("Invalid linked TI value: %u", linked_ti);
        return -1;
    }
    *output = linked_ti;
    return 0;
}

The key difference is the removal of the assert() and the addition of input validation and graceful error handling.

Exploitation & Lab Setup

Red Team (Exploitation):

Since no public exploit code is available, the following is a conceptual approach for testing in a lab environment.

1. Lab Setup:

   • Deploy a Magma 1.8.0 core network (e.g., using the official Magma deployment scripts).
   • Set up a test UE (User Equipment) or use a tool like scapy to craft NAS packets.
   • Ensure network connectivity between the attacker machine and the Magma MME.

2. Crafting the Malicious NAS Packet:

   • Use a tool like scapy or a custom Python script to create a NAS packet.
   • The packet should target the decode_linked_ti_ie function. This typically involves setting the Linked TI IE to an invalid value (e.g., > 7).
   • Example using scapy (conceptual):

     from scapy.all import *
     # Build a NAS packet with a malformed Linked TI IE
     # This is a simplified example; actual NAS packet structure is more complex
     packet = IP(dst="MME_IP")/UDP(sport=12345, dport=36412)/Raw(load=b'\x00'*100)
     send(packet)
     

3. Triggering the DoS:

   • Send the crafted packet to the MME's NAS port (typically UDP 36412 for S1AP or 38412 for NGAP).
   • Monitor the MME process. If successful, the MME process will crash, and the service will become unavailable.

Blue Team (Defense & Detection):

1. Detection:

   • Monitor for abnormal NAS packet patterns, especially those with invalid or out-of-range values in the Linked TI IE.
   • Use network intrusion detection systems (NIDS) to flag packets that trigger assertion failures.

2. Mitigation:

   • Immediately apply the patch by upgrading to Magma v1.9 or later.
   • If patching is not immediately possible, implement a Web Application Firewall (WAF) or network filter to block malformed NAS packets.
   • Enable process monitoring and auto-restart for the MME service to minimize downtime.

Indicators of Compromise (IOCs)

• Network IOCs:

  • UDP packets destined to port 36412 or 38412 with malformed NAS payloads.
  • Repeated connection attempts from a single IP address to the MME.
  • Log entries indicating assertion failures in the MME process (e.g., "Assertion failed: linked_ti <= 7").

• System IOCs:

  • Unexpected termination of the MME process (e.g., mme or mme_app).
  • Core dump files generated by the MME process.
  • High CPU or memory usage immediately before the crash.

• File IOCs:

  • Log files containing assertion failure messages (e.g., /var/log/magma/mme.log).

Detection Engineering

YARA Rule:

rule CVE_2024_24420_Magma_NAS_Assertion {
    meta:
        description = "Detects malformed NAS packets targeting CVE-2024-24420 in Magma"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24420"
    strings:
        $assert_msg = "Assertion failed" ascii wide nocase
        $linked_ti = "linked_ti" ascii wide nocase
    condition:
        $assert_msg and $linked_ti
}

Sigma Rule:

title: Magma MME Assertion Failure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects assertion failures in Magma MME logs, indicating potential exploitation of CVE-2024-24420
author: Valters IT
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "Assertion failed"
        - "linked_ti"
    condition: selection
falsepositives:
    - Legitimate debugging with assertions enabled
level: high

Suricata Rule:

alert udp any any -> any 36412 (msg:"CVE-2024-24420 Magma NAS Malformed Packet"; content:"|00|"; depth:1; byte_test:1,>,7,0; sid:1000001; rev:1;)

Note: This is a simplified rule. A real rule would need to parse the NAS packet structure more precisely.

Remediation & Mitigation

1. Immediate Patch:

   • Upgrade Magma to version 1.9 or later, specifically including commit 08472ba98b8321f802e95f5622fa90fec2dea486.
   • If using a containerized deployment, rebuild and redeploy the MME container with the patched code.

2. Workaround (if patching is delayed):

   • Implement network-level filtering to block suspicious NAS packets.
   • Enable process monitoring and automatic restart for the MME service.
   • Restrict network access to the MME to trusted IP addresses only.

3. Long-term Prevention:

   • Conduct a code review of all assertion statements in the codebase to ensure they are not reachable from external input.
   • Implement fuzz testing for NAS packet parsing to identify similar vulnerabilities.
   • Adopt secure coding practices, such as using error handling instead of assertions for input validation.

Valters IT