CVE-2024-24442

Executive Summary

CVE-2024-24442 is a critical Denial of Service (DoS) vulnerability in the OpenAirInterface CN5G AMF (Access and Mobility Management Function) component, up to version 2.0.0. The flaw resides in the ngap_app::handle_receive routine, where a crafted NGAP (Next Generation Application Protocol) message can trigger a NULL pointer dereference. This allows an unauthenticated, remote attacker to crash the AMF process, effectively disrupting 5G core network operations. The vulnerability has a CVSS score of 7.5 (High) due to its network-based, low-complexity attack vector with no required privileges or user interaction. No public exploit code or proof-of-concept is currently available, but the technical details are sufficient for a determined attacker to develop one.

Supply Chain & Package Security

This vulnerability affects the OpenAirInterface CN5G AMF, an open-source 5G core network component. As an open-source project, the supply chain risk is moderate; organizations using this software must ensure they are not running a vulnerable version. The lack of a published patch increases the urgency for manual mitigation or vendor engagement.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The attacker can send the malicious NGAP message over the network.
• Attack Complexity: Low (AC:L) – No special conditions or knowledge required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – The AMF process crashes, causing a denial of service.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it a prime target for attackers aiming to disrupt 5G network services.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the ngap_app::handle_receive function of the OpenAirInterface CN5G AMF. This function is responsible for processing incoming NGAP messages, which are used for signaling between the gNodeB (base station) and the AMF in a 5G core network.

Root Cause: The handle_receive routine does not properly validate the structure of incoming NGAP messages. When a specially crafted message is received, the code attempts to dereference a pointer that is NULL, leading to a segmentation fault and process crash.

Attack Vector: An attacker can send a malicious NGAP message over the N2 interface (between gNodeB and AMF) or potentially from a compromised gNodeB. The message is crafted to exploit the lack of input validation, causing the NULL pointer dereference.

Impact: Successful exploitation results in a Denial of Service (DoS) of the AMF. Since the AMF is a critical component of the 5G core, its failure can disrupt mobility management, session establishment, and overall network connectivity for all users attached to that AMF.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

void ngap_app::handle_receive(NGAP_Message *msg) {
    // Assume msg->someField is always valid
    process_field(msg->someField);  // NULL pointer dereference if msg->someField is NULL
}

Patched Code (Conceptual):

void ngap_app::handle_receive(NGAP_Message *msg) {
    if (msg == NULL || msg->someField == NULL) {
        // Log error and discard message
        return;
    }
    process_field(msg->someField);
}

The fix involves adding a NULL check before dereferencing any pointer from the incoming message. Without an official patch, users must implement such checks manually or apply a workaround.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running OpenAirInterface CN5G AMF v2.0.0 or earlier.
• Network access to the N2 interface (port 38412 SCTP by default).
• A tool to craft and send SCTP/NGAP messages (e.g., Scapy, custom Python script).

Exploitation Steps:

1. Identify Target: Scan for open SCTP port 38412 on the target AMF.
2. Craft Malicious NGAP Message: Create an NGAP message that triggers the NULL pointer dereference. This typically involves setting a specific Information Element (IE) to a NULL value or omitting a mandatory field.
3. Send Message: Use a script to send the crafted message over SCTP to the target.
4. Verify DoS: The AMF process should crash, causing a loss of connectivity.

Example Python Script (Conceptual):

import socket
import struct

def craft_malicious_ngap():
    # Craft a malformed NGAP message that triggers NULL dereference
    # This is a placeholder; actual payload requires deep knowledge of NGAP ASN.1
    payload = b'\x00' * 100  # Example malformed data
    return payload

def send_sctp(ip, port, payload):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_SCTP)
    sock.connect((ip, port))
    sock.send(payload)
    sock.close()

if __name__ == "__main__":
    target_ip = "192.168.1.100"
    target_port = 38412
    payload = craft_malicious_ngap()
    send_sctp(target_ip, target_port, payload)

Blue Team (Defense & Detection)

Detection:

• Monitor for crashes of the AMF process (e.g., oai_amf).
• Look for unusual NGAP messages with missing or malformed IEs.
• Use network monitoring to detect anomalous SCTP traffic on port 38412.

Mitigation:

• Immediate: If possible, restrict network access to the N2 interface to trusted gNodeBs only.
• Short-term: Apply a workaround by adding input validation in the handle_receive function (if source code is accessible).
• Long-term: Wait for an official patch from OpenAirInterface or consider using a different AMF implementation.

Indicators of Compromise (IOCs)

• Network IOCs:
  • SCTP packets on port 38412 with malformed NGAP messages (e.g., missing mandatory IEs).
  • Repeated connection attempts from unknown IPs to the AMF.
• System IOCs:
  • AMF process crash logs (e.g., segmentation fault in ngap_app::handle_receive).
  • Core dump files from the AMF process.
• Log IOCs:
  • Log entries indicating "NULL pointer dereference" or "Segmentation fault" in the AMF logs.

Detection Engineering

YARA Rule

rule CVE_2024_24442_NGAP_NULL_DEREF {
    meta:
        description = "Detects malformed NGAP messages targeting CVE-2024-24442"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24442"
    strings:
        $ngap_header = { 00 1? 00 00 }  // Example NGAP header pattern
        $null_field = { 00 00 00 00 }   // Potential NULL pointer trigger
    condition:
        $ngap_header and $null_field
}

Sigma Rule

title: CVE-2024-24442 NGAP NULL Pointer Dereference
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-24442 via malformed NGAP messages
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/oai_amf'
        CommandLine|contains: 'segfault'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert sctp any any -> any 38412 (msg:"CVE-2024-24442 NGAP NULL Pointer Dereference Attempt"; content:"|00 00 00 00|"; depth:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict network access to the AMF N2 interface (port 38412 SCTP) to only trusted gNodeB IP addresses.
   • Monitor AMF logs for crashes and anomalous NGAP messages.

2. Short-term Mitigation:

   • If you have access to the source code, add NULL pointer checks in the ngap_app::handle_receive function before dereferencing any pointers from incoming messages.
   • Consider deploying a Web Application Firewall (WAF) or intrusion prevention system (IPS) that can inspect SCTP/NGAP traffic.

3. Long-term Fix:

   • Apply the official patch from OpenAirInterface when it becomes available.
   • Upgrade to a patched version of the AMF (e.g., v2.0.1 or later).
   • Evaluate alternative AMF implementations that are not affected.

4. Compensating Controls:

   • Implement redundancy (e.g., multiple AMF instances) to ensure high availability.
   • Use network segmentation to isolate the 5G core network.

Valters IT