CVE-2024-24446

Executive Summary

CVE-2024-24446 is a critical Denial of Service (DoS) vulnerability in the OpenAirInterface (OAI) CN5G Access and Mobility Management Function (AMF) component, affecting versions up to v2.0.0. The flaw resides in the handling of a crafted InitialContextSetupResponse message, where an uninitialized pointer dereference occurs. This allows an unauthenticated attacker on the network to crash the AMF process, effectively disrupting 5G core network operations. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the impact, it represents a high-severity availability threat to 5G testbeds and deployments using OAI software. No public proof-of-concept (PoC) or patch is currently available, making this a zero-day risk for unpatched systems.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0, a reasonable assessment based on the description yields:

• Attack Vector (AV): Network (N) – The attacker sends a crafted message over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of AMF service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High – Exploitation can cause a complete DoS of the 5G core AMF, impacting all connected gNodeBs and UEs.

Deep Dive & Mechanics

The vulnerability is an uninitialized pointer dereference (CWE-824) in the AMF's handling of the InitialContextSetupResponse message. In 5G core networks, the AMF manages registration, mobility, and session context. The InitialContextSetupResponse is a legitimate NGAP (Next Generation Application Protocol) message sent by a gNodeB to confirm the setup of a UE context.

The flaw occurs when the AMF processes a malformed or unexpected InitialContextSetupResponse. Specifically, the AMF code likely allocates a pointer for a data structure (e.g., a UE context or session object) but fails to initialize it before use. When a crafted message is received, the code dereferences this uninitialized pointer, leading to a read or write to an invalid memory address. This typically results in a segmentation fault, crashing the AMF process.

The attack does not require authentication; the attacker only needs network access to the AMF's N2 interface (the interface between the AMF and gNodeBs). By sending a single crafted packet, the attacker can cause a persistent DoS until the AMF is manually restarted.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is inferred from the CWE description. The vulnerable code likely resembles:

// Vulnerable pattern (pseudo-code)
void handle_initial_context_setup_response(NGAP_Message *msg) {
    UE_Context *ctx; // Uninitialized pointer
    // ... parsing logic ...
    ctx->state = ACTIVE; // Dereference of uninitialized pointer
}

A patched version would initialize the pointer before use:

// Patched pattern (pseudo-code)
void handle_initial_context_setup_response(NGAP_Message *msg) {
    UE_Context *ctx = NULL; // Initialize to NULL
    // ... parsing logic ...
    if (ctx == NULL) {
        // Handle error, reject message
        return;
    }
    ctx->state = ACTIVE;
}

Without an official patch, users must apply manual mitigations (see Remediation & Mitigation).

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Network access to the AMF's N2 interface (port 38412/SCTP by default for NGAP).
• Ability to craft a malformed InitialContextSetupResponse message.

Exploitation Steps:

1. Identify Target: Scan for AMF services on port 38412 using SCTP.
2. Craft Malformed Message: Use a tool like scapy or a custom SCTP/NGAP fuzzer to create an InitialContextSetupResponse with an invalid or missing mandatory IE (Information Element) that triggers the uninitialized pointer.
3. Send Message: Transmit the crafted packet to the AMF.
4. Observe DoS: The AMF process crashes, causing a loss of service.

Example Scapy Snippet (Conceptual):

from scapy.all import *
# This is a simplified example; real NGAP requires proper ASN.1 encoding
load_contrib("sctp")
pkt = IP(dst="192.168.1.100")/SCTP(sport=12345, dport=38412)/Raw(load=b'\x00'*100)
send(pkt)

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor for unexpected SCTP traffic on port 38412.
• Use network intrusion detection systems (NIDS) to flag malformed NGAP messages.
• Implement application-level monitoring to detect AMF crashes.

Mitigation:

• Restrict network access to the AMF N2 interface using firewall rules (allow only trusted gNodeB IPs).
• Deploy a Web Application Firewall (WAF) or NIDS with custom rules for NGAP protocol anomalies.
• Enable process monitoring and auto-restart for the AMF service (e.g., using systemd Restart=always).

Indicators of Compromise (IOCs)

• Network IOCs:
  • SCTP packets on port 38412 with malformed NGAP InitialContextSetupResponse messages.
  • Unusual ASN.1 encoding errors in NGAP traffic.
• System IOCs:
  • AMF process crash logs (e.g., segmentation fault, SIGSEGV).
  • Core dump files generated by the AMF process.
  • Log entries indicating "uninitialized pointer" or "null pointer dereference" errors.
• File IOCs:
  • /var/log/syslog or /var/log/messages entries showing AMF crashes.
  • Core dump files in /var/crash/ or /tmp/.

Detection Engineering

YARA Rule

rule CVE_2024_24446_AMF_DoS {
    meta:
        description = "Detects potential exploitation of CVE-2024-24446 via malformed NGAP messages"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24446"
    strings:
        $ngap_init = "InitialContextSetupResponse" ascii wide nocase
        $crash_sig = "SIGSEGV" ascii wide nocase
        $crash_msg = "uninitialized pointer" ascii wide nocase
    condition:
        $ngap_init and ($crash_sig or $crash_msg)
}

Sigma Rule

title: CVE-2024-24446 - AMF DoS via Uninitialized Pointer
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AMF crashes indicative of CVE-2024-24446 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "SIGSEGV"
        - "uninitialized pointer"
        - "AMF crashed"
    condition: selection
falsepositives:
    - Legitimate software bugs
level: high

Suricata Rule

alert sctp any any -> any 38412 (msg:"CVE-2024-24446 - Malformed NGAP InitialContextSetupResponse"; content:"|00 01 00 02|"; depth:4; sid:1000001; rev:1;)

Note: The Suricata rule above is a placeholder; a real rule would require deep packet inspection of NGAP ASN.1 content.

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Restrict access to the AMF N2 interface to only trusted gNodeB IP addresses using firewall rules.
2. Process Monitoring: Configure the AMF service to automatically restart on failure (e.g., systemctl edit openair-amf and add Restart=always).
3. Rate Limiting: Implement rate limiting on the N2 interface to reduce the impact of repeated attacks.

Long-Term Fix:

• Monitor the OpenAirInterface GitHub repository for an official patch.
• Apply the patch as soon as it is released.
• Consider upgrading to a patched version (currently none available).

Workaround:

• If source code access is available, manually initialize all pointers in the InitialContextSetupResponse handler to NULL and add null checks before dereferencing.

Valters IT