CVE-2024-24424

Executive Summary

CVE-2024-24424 is a denial-of-service (DoS) vulnerability in the Magma core network software, specifically in the decode_access_point_name_ie function. An attacker can trigger a reachable assertion by sending a crafted NAS (Non-Access Stratum) packet, causing the service to crash. This vulnerability affects Magma versions up to and including 1.8.0 and has been patched in version 1.9. The CVSS score is 0.0, indicating no official CVSS vector has been assigned, but the impact is a denial of service. No public proof-of-concept (PoC) or exploit code is available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High
• Threat Level: Medium (due to DoS impact and network-based attack)

Deep Dive & Mechanics

The vulnerability resides in the decode_access_point_name_ie function within the Magma core network's NAS packet processing logic. This function is responsible for parsing the Access Point Name (APN) Information Element from NAS messages. A reachable assertion occurs when the function receives a malformed or crafted packet that violates expected constraints. The assertion failure causes the process to abort, leading to a denial of service.

The root cause is insufficient input validation. The function does not properly check the length or structure of the APN IE before processing, allowing an attacker to send a packet that triggers an assertion. The fix in commit 08472ba98b8321f802e95f5622fa90fec2dea486 likely adds proper bounds checking or removes the assertion in favor of error handling.

Vulnerable vs. Patched Code

Vulnerable Code (Magma <= 1.8.0):

// Example vulnerable code snippet (hypothetical)
void decode_access_point_name_ie(uint8_t *data, uint16_t length) {
    // No length check before assertion
    assert(length >= MIN_APN_LENGTH);
    // Process data...
}

Patched Code (Magma v1.9):

// Example patched code snippet (hypothetical)
void decode_access_point_name_ie(uint8_t *data, uint16_t length) {
    if (length < MIN_APN_LENGTH) {
        // Return error instead of asserting
        return;
    }
    // Process data...
}

The patch replaces the assertion with a conditional check that returns an error, preventing the crash.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a Magma core network (version 1.8.0) in a lab environment.
2. Crafting the Payload: Use a tool like Scapy to craft a NAS packet with a malformed APN IE. The packet should have an invalid length or structure that triggers the assertion.
3. Execution: Send the crafted packet to the Magma MME (Mobility Management Entity) or other component that processes NAS messages.
4. Expected Outcome: The target service crashes, causing a denial of service.

Example Scapy script:

from scapy.all import *
# Craft a NAS packet with malformed APN IE
packet = IP(dst="target_ip")/UDP(sport=12345, dport=36412)/NAS(PDU="...")
send(packet)

Blue Team

1. Detection: Monitor for unusual NAS packets with abnormal APN IE lengths or structures.
2. Mitigation: Apply the patch by upgrading to Magma v1.9 or later.
3. Workaround: If patching is not possible, implement network-level filtering to block malformed NAS packets.

Indicators of Compromise (IOCs)

• Network IOCs:
  • NAS packets with APN IE length less than expected minimum (e.g., < 3 bytes).
  • Repeated assertion failure logs in Magma components.
• System IOCs:
  • Core dumps or crash logs from Magma processes.
  • Log entries containing "assertion failed" in decode_access_point_name_ie.

Detection Engineering

YARA Rule

rule CVE_2024_24424_Magma_DoS {
    meta:
        description = "Detects malformed NAS packets targeting Magma decode_access_point_name_ie"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24424"
    strings:
        $assert = "assertion failed" nocase
        $apn_ie = "decode_access_point_name_ie" nocase
    condition:
        $assert and $apn_ie
}

Sigma Rule

title: Magma CVE-2024-24424 DoS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects assertion failures in Magma decode_access_point_name_ie
author: Valters IT
logsource:
    product: magma
    service: mme
detection:
    selection:
        EventID: 1000
        Message: "*assertion failed*decode_access_point_name_ie*"
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert udp any any -> any 36412 (msg:"CVE-2024-24424 Magma DoS Attempt"; content:"|00 01|"; depth:2; offset:0; content:"|02|"; distance:0; within:1; reference:cve,2024-24424; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Magma to version 1.9 or later, which includes the fix.
2. Workaround: If upgrading is not possible, implement network-level filtering to block malformed NAS packets. Use intrusion detection systems (IDS) to detect and alert on suspicious traffic.
3. Long-term: Ensure all input validation is robust and avoid reachable assertions in production code. Conduct regular security audits and fuzz testing.

Valters IT