CVE-2024-24450

Executive Summary

CVE-2024-24450 is a critical stack-based buffer overflow vulnerability in the OpenAirInterface (OAI) CN5G Access and Mobility Management Function (AMF) component, version 2.0.0 and earlier. The flaw resides in the ngap_handle_pdu_session_resource_setup_response routine, which processes N2 interface messages. By sending a specially crafted PDU Session Resource Setup Response message with an excessively large FailedToSetupList Information Element (IE), a remote attacker with network access to the N2 interface can trigger a stack-based buffer overflow. This can lead to a denial of service (DoS) against the AMF and potentially allow arbitrary code execution. The vulnerability is unpatched as of the latest advisory, and no public exploit code or proof-of-concept is available. Given the critical role of the AMF in 5G core networks, this vulnerability poses a significant risk to the availability and integrity of 5G services.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned by NVD. However, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The attacker must have access to the N2 interface.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the AMF.
• Confidentiality (C): High (H) – Potential for code execution leading to data exfiltration.
• Integrity (I): High (H) – Potential for code execution leading to system modification.
• Availability (A): High (H) – Direct DoS impact.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows remote, unauthenticated exploitation on a core network function, with potential for full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow (CWE-121) in the ngap_handle_pdu_session_resource_setup_response function within the OAI CN5G AMF. This function is responsible for processing N2AP (N2 Application Protocol) messages, specifically the PDU Session Resource Setup Response.

Technical Breakdown:

1. Protocol Context: In 5G core networks, the AMF communicates with gNodeBs (base stations) over the N2 interface using N2AP messages. The PDU Session Resource Setup Response is sent by the gNodeB to the AMF to confirm the setup of a PDU session resource, which includes a list of failed resources (FailedToSetupList IE).

2. Vulnerable Code Path: The ngap_handle_pdu_session_resource_setup_response routine uses a fixed-size stack buffer to copy the FailedToSetupList IE. The code likely performs a memcpy or similar operation without proper bounds checking on the size of the incoming IE.

3. Trigger Mechanism: An attacker, acting as a malicious gNodeB or via a compromised network path, sends a PDU Session Resource Setup Response message where the FailedToSetupList IE is larger than the allocated stack buffer. This causes data to overflow into adjacent stack memory.

4. Impact:

   • Denial of Service (DoS): The overflow corrupts the stack, leading to a crash of the AMF process. This disrupts all 5G services handled by that AMF.
   • Potential Code Execution: By carefully crafting the overflow payload, an attacker can overwrite the return address or other critical stack data to redirect execution flow to attacker-controlled code. This could allow the attacker to execute arbitrary commands with the privileges of the AMF process (typically root or a high-privilege user).

5. Attack Surface: The N2 interface is typically exposed within the operator's trusted network, but it may be accessible from the internet if not properly segmented. An attacker with access to the N2 interface (e.g., via a compromised gNodeB or a network breach) can exploit this vulnerability.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the OAI CN5G AMF source code (version <= 2.0.0). The patched code would require proper bounds checking.

Vulnerable Code (Conceptual):

void ngap_handle_pdu_session_resource_setup_response(uint8_t *message, size_t msg_len) {
    uint8_t failed_to_setup_list[256]; // Fixed-size stack buffer
    size_t list_size = extract_failed_to_setup_list_size(message);
    // VULNERABLE: No bounds check on list_size
    memcpy(failed_to_setup_list, message + offset, list_size);
    // ... process the list
}

Patched Code (Conceptual):

void ngap_handle_pdu_session_resource_setup_response(uint8_t *message, size_t msg_len) {
    uint8_t failed_to_setup_list[256]; // Fixed-size stack buffer
    size_t list_size = extract_failed_to_setup_list_size(message);
    // PATCH: Bounds check before copy
    if (list_size > sizeof(failed_to_setup_list)) {
        // Log error, reject message, or truncate
        return;
    }
    memcpy(failed_to_setup_list, message + offset, list_size);
    // ... process the list
}

Exploitation & Lab Setup

Red Team (Exploitation)

Objective: Trigger a denial of service or achieve remote code execution on the OAI CN5G AMF.

Prerequisites:

• Access to the N2 interface (e.g., via a compromised gNodeB or direct network access).
• Knowledge of the target AMF's IP address and port (typically SCTP port 38412 for N2).
• A tool to craft and send raw SCTP/N2AP messages (e.g., Scapy, custom Python script, or a modified gNodeB simulator).

Exploitation Steps (DoS):

1. Craft Malicious Message: Create a PDU Session Resource Setup Response message with an oversized FailedToSetupList IE. The IE length should exceed the expected stack buffer size (e.g., > 256 bytes).
2. Send Message: Use a tool to send the crafted SCTP packet to the AMF's N2 interface.
3. Observe Crash: The AMF process should crash, causing a denial of service.

Exploitation Steps (Code Execution - Theoretical):

1. Analyze Binary: Reverse engineer the AMF binary to determine the exact stack layout and offset to the return address.
2. Craft Payload: Create a payload that overwrites the return address with a pointer to attacker-controlled shellcode. The shellcode could be placed within the overflowed buffer itself or in another part of the message.
3. Send Message: Transmit the crafted message.
4. Gain Access: If successful, the AMF process executes the shellcode, granting the attacker a shell or remote access.

Note: No public exploit code is available. The above is a theoretical exploitation path.

Blue Team (Defense & Detection)

Objective: Detect and prevent exploitation attempts.

Detection Strategies:

1. Network Monitoring: Monitor N2 interface traffic for anomalous PDU Session Resource Setup Response messages with unusually large FailedToSetupList IEs.
2. Anomaly Detection: Establish a baseline for normal N2AP message sizes and alert on deviations.
3. Memory Protection: Enable stack canaries, ASLR, and NX (non-executable stack) on the AMF host to mitigate exploitation.
4. Input Validation: Implement strict bounds checking on all N2AP message IEs before processing.

Lab Setup:

• Environment: Virtual machines running Ubuntu 20.04/22.04.
• AMF Instance: Deploy OAI CN5G AMF version 2.0.0 (vulnerable) in a controlled lab network.
• Attacker Machine: A separate VM with tools like Scapy, Python, and a custom N2AP message generator.
• Network: Isolated VLAN with SCTP connectivity between the attacker and AMF.

Indicators of Compromise (IOCs)

Network IOCs:

• SCTP packets on port 38412 (N2) with an unusually large payload size (> 1024 bytes) for a PDU Session Resource Setup Response message.
• N2AP messages containing a FailedToSetupList IE with a length field exceeding 256 bytes.
• Repeated connection attempts from a single source IP to the AMF's N2 interface.

Host IOCs:

• AMF process crash logs (e.g., segmentation fault, stack smashing detected).
• Core dump files generated by the AMF process.
• Unexpected memory access patterns in system logs (e.g., dmesg output showing "buffer overflow detected").
• Unusual child processes spawned by the AMF (indicating potential code execution).

File IOCs:

• Modified AMF binary or configuration files (if code execution achieved).
• Suspicious scripts or binaries in the AMF's working directory.

Detection Engineering

YARA Rule

rule CVE_2024_24450_N2AP_Overflow {
    meta:
        description = "Detects N2AP PDU Session Resource Setup Response messages with oversized FailedToSetupList IE"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24450"
        hash = "unknown"
    strings:
        $n2ap_header = { 00 15 00 00 } // N2AP PDU Session Resource Setup Response (example)
        $failed_list_ie = { 00 5A } // FailedToSetupList IE tag (example)
        $large_length = /[\x01-\xFF][\x01-\xFF]/ // Length > 256 bytes (2-byte length field)
    condition:
        $n2ap_header at 0 and $failed_list_ie and #large_length > 1
}

Sigma Rule

title: CVE-2024-24450 - N2AP Buffer Overflow Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects oversized N2AP PDU Session Resource Setup Response messages indicating exploitation attempt
author: Valters IT
date: 2024/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24450
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: 'n2ap'
        event_type: 'alert'
        alert.signature_id: 3000001
    condition: selection
falsepositives:
    - Legitimate large messages from gNodeBs (rare)
level: high

Suricata Rule

alert sctp $EXTERNAL_NET any -> $HOME_NET 38412 (msg:"CVE-2024-24450 - N2AP PDU Session Resource Setup Response Buffer Overflow Attempt"; flow:to_server; content:"|00 15 00 00|"; depth:4; content:"|00 5A|"; distance:0; within:2; byte_test:2,>,256,0,relative; classtype:attempted-dos; sid:3000001; rev:1;)

Remediation & Mitigation

Immediate Mitigations:

1. Network Segmentation: Restrict access to the N2 interface to only trusted gNodeBs and network segments. Use firewalls and ACLs to block unauthorized access.
2. Input Validation: If source code is available, apply the bounds check patch as described in the "Vulnerable vs. Patched Code" section.
3. Memory Protections: Enable stack canaries, ASLR, and NX on the AMF host to make exploitation more difficult.
4. Monitoring: Deploy the provided detection rules (YARA, Sigma, Suricata) to monitor for exploitation attempts.

Long-Term Remediation:

1. Apply Patch: Monitor the OpenAirInterface GitHub repository for an official patch. Once released, apply it immediately.
2. Upgrade: Upgrade to a patched version of the OAI CN5G AMF when available.
3. Code Audit: Conduct a thorough security audit of the N2AP message handling code to identify and fix similar vulnerabilities.
4. Fuzzing: Implement fuzz testing for N2AP message parsers to discover other potential overflows.

Workaround:

• If patching is not possible, consider deploying a virtual patching solution (e.g., WAF or IPS) that can inspect and block oversized N2AP messages.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert