CVE-2024-24426

Executive Summary

CVE-2024-24426 is a denial-of-service (DoS) vulnerability in OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0. The flaw resides in the NGAP_FIND_PROTOCOLIE_BY_ID function, which contains reachable assertions that can be triggered by a crafted NGAP (Next Generation Application Protocol) packet. An attacker can exploit this to cause a crash, leading to service disruption. No public exploit code or patch is currently available, and the CVSS score is listed as 0.0 due to incomplete NVD data, but the impact is clearly a DoS condition.

Supply Chain & Package Security

This vulnerability affects open-source 5G core network components (Magma and OAI EPC Federation). Organizations using these components in their infrastructure should monitor for updates from the OpenAirInterface project. Since no patch is available, supply chain risk is elevated, and alternative mitigations (e.g., network segmentation, rate limiting) should be considered.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD placeholder; actual severity likely Medium to High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: Medium (DoS only, no data breach)

Deep Dive & Mechanics

The vulnerability is in the NGAP protocol handler of OpenAirInterface Magma and OAI EPC Federation. The NGAP_FIND_PROTOCOLIE_BY_ID function is used to locate a specific Information Element (IE) within an NGAP message. When a malformed packet is sent, the function hits a reachable assertion (e.g., assert(pointer != NULL) or similar), causing the process to abort.

Root Cause: Lack of input validation before assertion checks. The function assumes the IE exists, but a crafted packet can omit or corrupt the IE, triggering the assertion.

Attack Vector: An unauthenticated attacker sends a specially crafted NGAP packet to the target (e.g., over the N2 interface). The packet is processed by the vulnerable function, causing a crash.

Impact: Denial of Service – the affected component (e.g., AMF or MME) becomes unavailable, disrupting 5G/EPC services.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void* NGAP_FIND_PROTOCOLIE_BY_ID(NGAP_Message_t* msg, int ie_id) {
    // No validation that IE exists
    void* ie = find_ie(msg, ie_id);
    assert(ie != NULL);  // Reachable assertion
    return ie;
}

Patched Code (Hypothetical):

void* NGAP_FIND_PROTOCOLIE_BY_ID(NGAP_Message_t* msg, int ie_id) {
    void* ie = find_ie(msg, ie_id);
    if (ie == NULL) {
        // Log error and return NULL or handle gracefully
        return NULL;
    }
    return ie;
}

The patch replaces the assertion with a conditional check, preventing the crash.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy OpenAirInterface Magma v1.8.0 or OAI EPC Federation v1.2.0 in a lab environment.
2. Craft Packet: Use a tool like Scapy or a custom NGAP fuzzer to create a malformed NGAP packet missing a required IE (e.g., ProcedureCode).
3. Send Packet: Transmit the packet to the target's N2 interface (e.g., using sock.send()).
4. Observe: The target process crashes, causing a DoS.

Example Scapy Script (Conceptual):

from scapy.all import *
# Craft a malformed NGAP packet (simplified)
packet = IP(dst="target_ip")/UDP(sport=36412, dport=36412)/Raw(b'\x00'*100)
send(packet)

Blue Team

1. Monitor: Watch for crashes in NGAP-related processes (e.g., mme, amf).
2. Detect: Use network monitoring to identify malformed NGAP packets (e.g., missing IEs).
3. Mitigate: Implement rate limiting on N2 interfaces and use a Web Application Firewall (WAF) to filter malformed packets.

Indicators of Compromise (IOCs)

• Network: NGAP packets with missing or malformed IEs (e.g., ProcedureCode, ProtocolIE-ID).
• Logs: Assertion failures in logs (e.g., assert(ie != NULL) failed).
• Process: Crash of mme or amf processes.
• File: Core dumps in /var/crash/ or similar.

Detection Engineering

YARA Rule

rule CVE_2024_24426_NGAP_Assertion {
    meta:
        description = "Detects NGAP packets triggering assertion in NGAP_FIND_PROTOCOLIE_BY_ID"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24426"
    strings:
        $assert = "assert(ie != NULL)" nocase
        $ngap = "NGAP_FIND_PROTOCOLIE_BY_ID" nocase
    condition:
        $ngap and $assert
}

Sigma Rule

title: CVE-2024-24426 NGAP Assertion Failure
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects assertion failures in NGAP_FIND_PROTOCOLIE_BY_ID
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/mme' or '/amf'
        CommandLine|contains: 'assert'
    condition: selection
falsepositives:
    - Legitimate debugging
level: high

Suricata Rule

alert udp any any -> any 36412 (msg:"CVE-2024-24426 NGAP Malformed Packet"; content:"|00 00|"; depth:2; byte_test:1,<,10,0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Await official patch from OpenAirInterface. Monitor their GitHub repository.
2. Workaround: Disable NGAP processing on untrusted interfaces, or use a network firewall to filter malformed NGAP packets.
3. Rate Limiting: Limit the number of NGAP messages per second from a single source.
4. Monitoring: Enable assertion failure logging and alert on crashes.
5. Segmentation: Isolate 5G core components in a separate network segment.

Valters IT