CVE-2024-24449

Executive Summary

CVE-2024-24449 is a critical Denial of Service (DoS) vulnerability in the OpenAirInterface CN5G Access and Mobility Management Function (AMF) component, affecting versions up to v2.0.0. The flaw resides in the NasPdu::NasPdu constructor, where an uninitialized pointer dereference occurs when processing a crafted InitialUEMessage message. An attacker can exploit this by sending a specially crafted NAS PDU to the AMF, causing the service to crash and resulting in a denial of service for legitimate 5G core network operations. No public exploit code or proof-of-concept is currently available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects the OpenAirInterface CN5G AMF, which is a core network component for 5G systems. It is not a package manager (NPM, PyPI, Go, Ruby) issue, but rather a source-code level flaw in a critical network infrastructure component. Organizations using OpenAirInterface for 5G core deployments should treat this as a high-priority supply chain risk, as the AMF is a central element in 5G signaling.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for a full vector. However, based on the vulnerability description and impact, a reasonable assessment is:

• Attack Vector (AV): Network (AV:N) – The attack is performed over the network.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerable component is the only one affected.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – Complete loss of availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High. The vulnerability is remotely exploitable without authentication, and a successful attack can crash the AMF, disrupting 5G core services.

Deep Dive & Mechanics

The vulnerability is an uninitialized pointer dereference in the NasPdu::NasPdu constructor. In C++, when a pointer member variable is not initialized in the constructor, it contains a garbage value (pointing to an arbitrary memory location). If the code later dereferences this pointer without checking for validity, it can cause a segmentation fault or other memory access violation.

In the context of OpenAirInterface CN5G AMF, the NasPdu class is used to parse and handle NAS (Non-Access Stratum) PDUs from UE (User Equipment) messages, such as InitialUEMessage. When a crafted message is sent, the constructor may fail to properly initialize a pointer, leading to a crash when the AMF attempts to access the data.

The attack flow:

1. Attacker sends a crafted InitialUEMessage to the AMF over the N1/N2 interface.
2. The AMF parses the message and creates a NasPdu object.
3. Due to the uninitialized pointer, the constructor does not set the pointer to a valid memory address.
4. When the AMF later dereferences this pointer (e.g., to read NAS PDU content), it accesses invalid memory.
5. The AMF process crashes, causing a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (OpenAirInterface CN5G AMF <= v2.0.0):

// NasPdu.h
class NasPdu {
public:
    NasPdu();
    // ...
private:
    uint8_t* data;  // Uninitialized pointer
    size_t length;
};

// NasPdu.cpp
NasPdu::NasPdu() {
    // Constructor does NOT initialize 'data' pointer
    length = 0;
}

Patched Code (Hypothetical fix):

// NasPdu.h
class NasPdu {
public:
    NasPdu();
    // ...
private:
    uint8_t* data;  // Now initialized to nullptr
    size_t length;
};

// NasPdu.cpp
NasPdu::NasPdu() : data(nullptr), length(0) {
    // Properly initialize pointer to nullptr
}

The fix ensures that the data pointer is initialized to nullptr in the constructor's initializer list. Additionally, all dereferences of data should check for nullptr before use.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to a 5G core network running OpenAirInterface CN5G AMF <= v2.0.0.
• Ability to send NAS messages over the N1 interface (e.g., via a simulated UE or direct network access).

Exploit Steps:

1. Craft a malicious InitialUEMessage with a malformed NAS PDU that triggers the uninitialized pointer.
2. Send the message to the AMF's N1/N2 interface.
3. Observe the AMF crash (e.g., via logs or process monitoring).

Example Python script (conceptual):

import socket

def craft_malicious_initial_ue_message():
    # This is a simplified example; actual NAS PDU structure is more complex
    # The key is to send a message that causes NasPdu constructor to leave pointer uninitialized
    nas_pdu = b'\x00' * 10  # Placeholder for malformed NAS PDU
    initial_ue_message = b'\x00' * 100  # Placeholder for full message
    return initial_ue_message

def send_exploit(target_ip, target_port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    payload = craft_malicious_initial_ue_message()
    sock.send(payload)
    sock.close()

if __name__ == "__main__":
    send_exploit("192.168.1.100", 38412)  # Example AMF SCTP port

Note: No public exploit code exists. The above is a conceptual example.

Blue Team (Defense & Detection)

Detection:

• Monitor AMF logs for crashes or segmentation faults.
• Use network monitoring to detect malformed NAS PDUs.
• Implement rate limiting on InitialUEMessage processing.

Mitigation:

• Apply vendor patch when available.
• If patching is not possible, consider deploying a Web Application Firewall (WAF) or intrusion prevention system (IPS) to filter malformed NAS messages.
• Restrict network access to the AMF to trusted sources only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual InitialUEMessage packets with malformed NAS PDU content.
  • Repeated connection attempts to AMF port 38412 (SCTP) from untrusted IPs.
• System IOCs:
  • AMF process crash logs containing segmentation fault or SIGSEGV.
  • Core dumps from the AMF process.
• Log IOCs:
  • Log entries indicating "NasPdu::NasPdu" constructor failure or uninitialized pointer access.

Detection Engineering

YARA Rule

rule CVE_2024_24449_NasPdu_Uninit_Pointer {
    meta:
        description = "Detects uninitialized pointer dereference in NasPdu constructor"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-24449"
    strings:
        $s1 = "NasPdu::NasPdu" ascii wide nocase
        $s2 = "data" ascii wide nocase
        $s3 = "length" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) and #s1 > 0
}

Sigma Rule

title: CVE-2024-24449 - OpenAirInterface AMF DoS via Uninitialized Pointer
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AMF crashes caused by uninitialized pointer dereference in NasPdu
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/amf'
        CommandLine|contains: 'segfault'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 38412 (msg:"CVE-2024-24449 - OpenAirInterface AMF DoS via Uninitialized Pointer"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"|00 00 00 00|"; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule is a placeholder; actual detection requires deep packet inspection of NAS PDU content.

Remediation & Mitigation

Immediate Actions:

1. Isolate AMF: Restrict network access to the AMF to only trusted 5G core components.
2. Monitor: Enable detailed logging and monitoring for AMF crashes.
3. Rate Limit: Implement rate limiting on InitialUEMessage processing to reduce impact.

Long-term Fix:

• Apply vendor patch when released.
• If no patch is available, consider modifying the source code to initialize the data pointer to nullptr and add null checks before dereferencing.

Workaround:

• Use a network-based IPS/IDS to filter malformed NAS PDUs.
• Deploy a reverse proxy or load balancer that validates NAS messages before forwarding to the AMF.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System.