CVE-2024-24443

Executive Summary

CVE-2024-24443 is a critical Denial of Service (DoS) vulnerability in the OpenAirInterface CN5G AMF (Access and Mobility Management Function) component, specifically within the ngap_handle_pdu_session_resource_setup_response routine. The flaw is an uninitialized pointer dereference (CWE-824) that can be triggered by a crafted PDU Session Resource Setup Response message. An attacker with network access to the AMF can exploit this to cause a crash, leading to a complete denial of service for 5G core network functions. The vulnerability affects versions up to v2.0.0, and no official patch has been released at the time of analysis. The CVSS score is 7.5 (High) due to the low attack complexity and network-based attack vector.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The AMF becomes completely unavailable.

Threat Level: High. The vulnerability allows a remote, unauthenticated attacker to crash the AMF, which is a critical component in 5G core networks. This can disrupt all 5G services relying on that AMF.

Deep Dive & Mechanics

The vulnerability resides in the ngap_handle_pdu_session_resource_setup_response function within the OpenAirInterface CN5G AMF. This function is responsible for processing PDU Session Resource Setup Response messages, which are part of the NG Application Protocol (NGAP) used in 5G networks.

The root cause is an uninitialized pointer dereference. When the AMF receives a crafted PDU Session Resource Setup Response, the code attempts to access a pointer that has not been properly initialized. This leads to a read from an invalid memory address, causing a segmentation fault and crashing the AMF process.

The attack is straightforward: an attacker sends a specially crafted NGAP message to the AMF's N2 interface. The AMF parses the message and, due to the missing initialization, dereferences a pointer that points to arbitrary memory. The result is an immediate crash of the AMF, requiring a restart to restore service.

Vulnerable vs. Patched Code

The vulnerable code path is in the ngap_handle_pdu_session_resource_setup_response function. The exact vulnerable code is not publicly available, but the issue is the lack of initialization of a pointer before use.

Vulnerable Code (Conceptual):

void ngap_handle_pdu_session_resource_setup_response(NGAP_PDU_SESSION_RESOURCE_SETUP_RESPONSE_t *response) {
    // Pointer is declared but not initialized
    SomeStruct *ptr;
    // ... some processing ...
    // Dereference without checking if ptr is initialized
    if (ptr->field == VALUE) {
        // ...
    }
}

Patched Code (Conceptual):

void ngap_handle_pdu_session_resource_setup_response(NGAP_PDU_SESSION_RESOURCE_SETUP_RESPONSE_t *response) {
    // Pointer is initialized to NULL
    SomeStruct *ptr = NULL;
    // ... some processing ...
    // Check if ptr is initialized before dereferencing
    if (ptr != NULL && ptr->field == VALUE) {
        // ...
    }
}

The fix involves initializing the pointer to NULL and adding a null check before dereferencing it.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to the AMF's N2 interface (port 38412 SCTP by default).
• Knowledge of NGAP protocol and ASN.1 encoding.
• A tool to craft and send custom SCTP packets (e.g., Scapy, custom Python script).

Exploitation Steps:

1. Craft a malicious PDU Session Resource Setup Response: Create an NGAP message with a malformed or missing field that triggers the uninitialized pointer.
2. Send the message to the AMF: Use a tool to send the crafted SCTP packet to the AMF's N2 interface.
3. Observe the crash: The AMF process will crash, causing a denial of service.

Example Python Script (Conceptual):

import socket
import struct

# Craft a malicious NGAP message (simplified)
def craft_malicious_ngap():
    # This is a placeholder - actual ASN.1 encoding is complex
    # The key is to omit or malform a field that leads to uninitialized pointer
    malicious_payload = b'\x00' * 100  # Placeholder
    return malicious_payload

# Send over SCTP
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_SCTP)
sock.connect(('target_amf_ip', 38412))
sock.send(craft_malicious_ngap())
sock.close()

Blue Team

Detection:

• Monitor for unexpected crashes of the AMF process.
• Look for malformed NGAP messages in network traffic.
• Use the Sigma and Suricata rules provided below.

Mitigation:

• Apply the patch as soon as it becomes available.
• Restrict network access to the AMF's N2 interface to trusted sources only.
• Implement network segmentation to limit exposure.
• Use an IDS/IPS to detect and block malicious NGAP messages.

Indicators of Compromise (IOCs)

• Network:
  • SCTP packets on port 38412 with malformed NGAP PDU Session Resource Setup Response messages.
  • Unexpected AMF process crashes.
• System:
  • Core dumps from the AMF process.
  • Logs showing segmentation faults in ngap_handle_pdu_session_resource_setup_response.
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_24443_AMF_DoS {
    meta:
        description = "Detects malformed NGAP messages targeting CVE-2024-24443"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24443"
    strings:
        $ngap_procedure = { 00 01 00 02 }  // Example NGAP procedure code for PDU Session Resource Setup Response
        $malformed_field = { FF FF FF FF }  // Placeholder for malformed field
    condition:
        $ngap_procedure and $malformed_field
}

Sigma Rule

title: CVE-2024-24443 - AMF DoS via Malformed NGAP Message
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects malformed NGAP PDU Session Resource Setup Response messages targeting OpenAirInterface AMF
author: Valters IT
date: 2025/04/10
logsource:
    category: network
    product: suricata
detection:
    selection:
        - app_proto: "ngap"
        - event_type: "alert"
        - alert.signature_id: 1000001
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert sctp any any -> any 38412 (msg:"CVE-2024-24443 - Malformed NGAP PDU Session Resource Setup Response"; content:"|00 01 00 02|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply the official patch from OpenAirInterface when released. Monitor their GitHub repository for updates.
2. Workaround: If patching is not possible, restrict network access to the AMF's N2 interface using firewall rules to allow only trusted N2 peers (e.g., gNBs).
3. Network Segmentation: Place the AMF in a separate network segment with strict access controls.
4. Monitoring: Implement the detection rules above to identify and block malicious traffic.
5. Incident Response: Have a plan to quickly restart the AMF in case of a DoS attack.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert