CVE-2024-24423

Executive Summary

CVE-2024-24423 is a buffer overflow vulnerability discovered in the Linux Foundation Magma project, specifically in the decode_esm_message_container function located at /nas/ies/EsmMessageContainer.cpp. The vulnerability affects Magma versions up to and including 1.8.0 and is fixed in version 1.9 (commit 08472ba98b8321f802e95f5622fa90fec2dea486). An attacker can exploit this flaw by sending a crafted NAS (Non-Access Stratum) packet, leading to a Denial of Service (DoS) condition. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder) and an EPSS score of 0.0%, indicating low exploitation probability in the wild. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a core C++ component of the Magma project, which is an open-source software platform for mobile network core infrastructure.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the vulnerability description, a reasonable CVSS vector would be:

• Attack Vector (AV): Network (N) – The attack is performed over the network via NAS packets.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The buffer overflow causes a crash, leading to DoS.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Threat Level: Medium (due to DoS impact but low exploitation probability).

Deep Dive & Mechanics

The vulnerability resides in the decode_esm_message_container function within the Magma project's NAS (Non-Access Stratum) protocol handling code. The function is responsible for decoding ESM (EPS Session Management) message containers from incoming NAS packets. A buffer overflow occurs when the function fails to properly validate the length of the incoming data before copying it into a fixed-size buffer. An attacker can craft a malicious NAS packet with an oversized ESM message container, causing the function to write beyond the allocated buffer boundaries. This overwrites adjacent memory, leading to a crash (DoS) and potentially arbitrary code execution in more severe scenarios.

The vulnerable code is in /nas/ies/EsmMessageContainer.cpp. The fix in commit 08472ba98b8321f802e95f5622fa90fec2dea486 likely adds proper bounds checking to prevent the overflow.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.8.0):

// Simplified vulnerable code
void decode_esm_message_container(EsmMessageContainer& container, const uint8_t* data, size_t len) {
    // No bounds check on len
    memcpy(container.buffer, data, len); // Buffer overflow if len > buffer size
}

Patched Code (>= 1.9.0):

// Simplified patched code
void decode_esm_message_container(EsmMessageContainer& container, const uint8_t* data, size_t len) {
    if (len > sizeof(container.buffer)) {
        // Handle error or truncate
        return;
    }
    memcpy(container.buffer, data, len);
}

The patch adds a length check to ensure the incoming data does not exceed the buffer size, preventing the overflow.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Magma network (e.g., a test deployment).
• Ability to send raw NAS packets (e.g., using Scapy or a custom tool).

Exploitation Steps:

1. Identify a target Magma node (e.g., MME or AGW).
2. Craft a NAS packet with an oversized ESM message container field.
3. Send the packet to the target.
4. The target crashes due to buffer overflow, causing a DoS.

Example Python script using Scapy:

from scapy.all import *
import socket

# Craft a malicious NAS packet
# This is a simplified example; actual NAS packet structure is more complex
packet = b'\x00' * 1000  # Oversized payload

# Send to target
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(packet, ("target_ip", 36412))  # S1AP port

Blue Team

Detection:

• Monitor for abnormal NAS packet sizes.
• Use network intrusion detection systems (NIDS) to flag oversized ESM containers.
• Enable logging on Magma nodes to capture crashes.

Mitigation:

• Apply the patch immediately (upgrade to v1.9 or later).
• Implement network segmentation to limit exposure.
• Use rate limiting to reduce impact of DoS attacks.

Indicators of Compromise (IOCs)

• Network: NAS packets with ESM message container length exceeding 255 bytes (typical maximum).
• System: Crash logs in Magma components (e.g., MME, AGW) showing buffer overflow in EsmMessageContainer.cpp.
• Memory: Abnormal memory usage or segmentation faults in the NAS processing module.

Detection Engineering

YARA Rule

rule CVE_2024_24423_Magma_Buffer_Overflow {
    meta:
        description = "Detects buffer overflow in Magma decode_esm_message_container"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24423"
    strings:
        $s1 = "decode_esm_message_container" ascii wide
        $s2 = "EsmMessageContainer" ascii wide
        $s3 = "memcpy" ascii wide
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-24423 Magma Buffer Overflow
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects buffer overflow in Magma decode_esm_message_container
author: Valters IT
date: 2024-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/magmad'
        CommandLine|contains: 'EsmMessageContainer'
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert udp any any -> any 36412 (msg:"CVE-2024-24423 Magma Buffer Overflow"; content:"|00 00 00 00|"; depth:4; offset:0; pcre:"/^.{0,4}\x00{100,}/R"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Magma to version 1.9 or later (commit 08472ba98b8321f802e95f5622fa90fec2dea486).
• If upgrade is not possible, apply the patch manually to EsmMessageContainer.cpp.

Long-term:

• Implement input validation for all NAS packet fields.
• Use memory-safe languages or add bounds checking in C++ code.
• Regularly update Magma to latest stable version.

Workarounds:

• Restrict network access to Magma nodes (e.g., firewall rules).
• Monitor for abnormal NAS traffic patterns.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert