CVE-2024-24425

Executive Summary

CVE-2024-24425 is an out-of-bounds read vulnerability in Magma v1.8.0 and OAI EPC Federation v1.20, specifically in the amf_as_establish_req function located at /tasks/amf/amf_as.cpp. The flaw is triggered by a crafted NAS (Non-Access Stratum) packet, enabling an unauthenticated remote attacker to cause a Denial of Service (DoS) condition in the Access and Mobility Management Function (AMF). This vulnerability is relevant to enterprises operating 4G/5G core network infrastructure based on Magma or OAI EPC Federation, with the potential to disrupt subscriber connectivity and core network availability. The vulnerability has no known public exploit, is not listed in CISA KEV, and has no official CVSS score assigned as of this report.

Technical Analysis

The vulnerability resides in the AMF (Access and Mobility Management Function) component of Magma's 5G core and OAI EPC Federation's LTE/5G core stack. The affected function, amf_as_establish_req, is responsible for processing NAS establishment request messages received from User Equipment (UE) via the gNodeB/eNodeB over the S1AP/NGAP interface.

Vulnerability Mechanism:
The out-of-bounds read occurs during the parsing and validation of fields within the NAS protocol data unit (PDU). The function fails to perform adequate bounds checking before reading memory offsets within the received packet buffer. When a crafted NAS packet contains malformed or truncated Information Elements (IEs), the code attempts to read beyond the allocated buffer boundaries, leading to an undefined read operation. This can result in:

• An access violation / segmentation fault, causing the AMF process to crash.
• Memory disclosure of adjacent heap/stack data (though the primary reported impact is DoS).
• Potential logic corruption if the out-of-bounds data is inadvertently used in subsequent processing.

Attack Surface:
The attack surface is the N1/N2 interface (NAS signaling) exposed to the radio access network. An attacker does not need valid credentials — the NAS packet is processed before authentication is established. The vulnerable function executes early in the NAS message handling pipeline, meaning the attacker does not need to complete any prior protocol handshake beyond establishing a basic SCTP connection to the S1AP/NGAP port (typically UDP/TCP port 38412 for SCTP S1AP, or 38422 for NGAP).

Code-Level Context:
The amf_as_establish_req function is invoked when the AMF receives an initial UE message containing a NAS establishment request. The function deserializes the NAS PDU to extract fields like 5GMM capability, UE security capability, and NAS message container. The out-of-bounds read likely stems from improper validation of the length field of the NAS message container IE or related nested IEs, where a declared length larger than the actual remaining buffer size results in a read past the buffer boundary.

Exploitation Scenarios

Attack Chain — Unauthenticated Remote DoS:

1. Reconnaissance / Target Identification:
   The attacker identifies target 4G/5G core networks by scanning for SCTP ports 38412 (S1AP) or 38422 (NGAP). Shodan dorks such as protocol:"s1ap" or scanning within a carrier's IP ranges can reveal exposed AMF/MME interfaces. Alternatively, compromised eNodeB/gNodeB credentials or a malicious UE in the operator's network can be used to reach the AMF.

2. Trigger / Weaponization:
   The attacker crafts a NAS attach request (or tracking area update request) with a maliciously formatted NAS message container. Specifically, the attacker sets the length field of an embedded IE (e.g., the 5GMM capability or the NAS message container itself) to a value that exceeds the remaining bytes in the packet buffer. The packet is encapsulated in an S1AP/NGAP INITIAL UE MESSAGE and transmitted over an existing SCTP association.

3. Payload / Execution:
   The crafted packet is forwarded by the gNodeB/eNodeB to the AMF. The amf_as_establish_req function processes the NAS PDU, reads the malicious length field, and performs a buffer read operation exceeding the allocated memory boundary. This triggers a crash in the AMF process (e.g., SIGSEGV in Linux), causing the AMF instance to terminate. If the AMF runs as a single-instance process without failover, all subscriber sessions serviced by that AMF are disrupted.

4. Post-Exploitation Impact:
   Upon AMF crash, new attach requests fail, existing UE sessions lose mobility management context, and inter-RAT handovers break. The attacker can repeat the attack in a loop using automated scripts to continuously crash the AMF, resulting in a sustained DoS against the core network. If the AMF is containerized (in Magma's case, it runs as a Docker container), the orchestration platform may restart it, but the attacker can simply re-trigger the crash, creating a crash-loop condition.

Note: The attack requires network-level access to the SCTP interface serving the AMF — a remote attacker with reachability to the core network's control plane can trigger this without authentication.

Impact Assessment

• CVSS Context: While an official CVSS score is not assigned (N/A), a reasonable assessment based on the vulnerability class yields a high severity score (CVSS 3.1 base vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5). The network attack vector, low complexity, and lack of privileges place this in the "High" severity band (7.0–8.9).
• Business Impact: Denial of service against the AMF disrupts all subscribers attached to that AMF, causing dropped sessions, failed attaches, and cascade failures in dependent network functions (e.g., SMF, UDM interactions become unreachable). For MNOs, this translates to loss of service revenue, SLA breaches, and degraded customer experience.
• Affected Systems: Magma v1.8.0 AMF (5G core) and OAI EPC Federation v1.20. Earlier versions may also be affected, but only these versions were explicitly disclosed.
• Blast Radius: A single crafted packet can crash one AMF instance. In distributed deployments with multiple AMFs (scale-out), only the affected AMF crashes, limiting blast radius to attached UEs. In small-cell or lab deployments (common for OAI), a single AMF serves the entire network, making the blast radius total.

Detection Guidance

Sigma Rule

title: CVE-2024-24425 Crafted NAS Packet Detected
id: 8f7d5c2a-3b1e-4c9d-8e2f-1a6b7c8d9e0f
status: experimental
description: Detects malformed NAS packets targeting Magma/OAI AMF amf_as_establish_req function
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: '/amf'
    CommandLine|contains: 'SCTP'
  filter:
    CommandLine|contains: 'normal'
  condition: selection and not filter
level: high
tags:
  - attack.t1499
  - attack.endpoint_denial_of_service

YARA Rule

rule CVE_2024_24425_NAS_OOB_Read
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects crafted NAS packets triggering out-of-bounds read in Magma AMF"
        cve = "CVE-2024-24425"
        date = "2024-01-15"
    strings:
        $s1 = "amf_as_establish_req" ascii
        $s2 = "NAS message container" ascii
        $s3 = "INITIAL UE MESSAGE" ascii
        $s4 = { 7e 00 00 00 }  // potential malformed length field pattern
    condition:
        any of them
}

Suricata IDS Rule

alert sctp any any -> any 38412 (msg:"CVE-2024-24425 OOB Read in Magma AMF NAS Packet"; flow:established,to_server; content:"|00 0c 01 00|"; depth:4; content:"|7e|"; within:10; content:"|00 00|"; within:20; reference:cve,2024-24425; classtype:attempted-dos; sid:100001; rev:1;)

Elastic Detection

// Detect AMF process crashes potentially caused by CVE-2024-24425
process where event.type == "process" and
  process.name == "amf" and
  process.exit_code != 0 and
  process.command_line contains "SCTP" and
  // Look for rapid restart cycles indicating crash-loop
  (process.name == "amf" and
    (sequence by process.pid with maxspan=1m
      [process where event.type == "start"]
      [process where event.type == "end" and process.exit_code != 0]
    ) or process.parent.name == "docker" and process.name == "amf"
  )

Splunk SPL Query

index=main sourcetype=linux_syslog
  OR sourcetype=container_logs
  (process_name="amf" OR image="*magma*amf*")
  OR (message="*amf_as_establish_req*" OR message="*SIGSEGV*")
  OR (message="*OUT_OF_BOUNDS*" OR message="*core dumped*")
  | stats count by host, process_name, message
  | where count > 3
  | table _time, host, process_name, message, count

Wazuh OSSEC Rule

<group name="magma_amf_dos,">
  <rule id="100015" level="12">
    <decoded_as>json</decoded_as>
    <field name="process">amf</field>
    <match>amf_as_establish_req|SIGSEGV|segmentation fault</match>
    <description>Magma AMF crashed - potential CVE-2024-24425 exploitation</description>
    <group>attack.t1499,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). No official vendor advisory or verified patch has been published at the time of this writing. The following guidance is based on best practices and available information.

1. Immediate Mitigations:

   • Network segmentation: Restrict SCTP access to the AMF (ports 38412/38422) to only trusted gNodeB/eNodeB IP addresses using firewall rules or VPC security groups.
   • Rate limiting: Implement rate limiting on SCTP traffic and NAS messages to reduce the impact of repeated crash attempts.
   • Process monitoring: Deploy automatic AMF process restart with health-check mechanisms to minimize downtime after a crash.
   • Input validation patch (temporary): If source code access is available (Magma is open source), apply a defensive bounds check in amf_as_establish_req around the NAS message container length field before the memcpy/read operation.

2. Patch/Upgrade Steps:

   • Magma: Monitor the official Magma GitHub repository (magma/magma) and release notes for a version newer than v1.8.0 that addresses this issue. If a patched version is released (e.g., v1.8.1 or later), upgrade immediately.
   • OAI EPC Federation: Check openairinterface releases for a patched version above v1.20.
   • Verify patch: If a claimed patch exists, verify it through independent testing — apply the fix and run the crafted packet proof-of-concept against a staging environment to confirm the crash no longer occurs.

3. Long-Term Hardening:

   • Fuzz testing: Integrate continuous fuzzing for NAS/S1AP/NGAP protocol parsing into the CI/CD pipeline using tools like AFL++ or libFuzzer to catch similar out-of-bounds issues before deployment.
   • Memory-safe language migration: For long-term development, consider reimplementation of critical parsing paths in Rust or Go, providing inherent memory safety.
   • Defense in depth: Deploy the AMF behind a security gateway or SCTP-aware IPS that inspects NAS payloads for known malformed patterns.
   • Immutable infrastructure: Run AMF instances as ephemeral containers with automatic restart and failover to a standby instance to ensure high availability.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-24425
2. Magma GitHub Repository: https://github.com/magma/magma (source for amf_as.cpp)
3. OpenAirInterface (OAI) Project: https://openairinterface.org/ (OAI EPC Federation source)
4. MITRE ATT&CK Technique T1499: https://attack.mitre.org/techniques/T1499/
5. CWE-125 Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html

Threat Actor Campaigns / E-WEB Evidence: No known active exploitation campaigns or exploit-in-the-wild evidence has been publicly reported for CVE-2024-24425 as of this publication. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, given the criticality of telecom core infrastructure and the relative ease of crafting malformed NAS packets, opportunistic exploitation by hacktivists or financially motivated actors targeting MNOs is considered plausible. Security teams should prioritize this patch/assessment if exposed to untrusted networks.