CVE-2024-24417
📋 TL;DR
A buffer overflow vulnerability in Magma's decode_protocol_configuration_options function allows attackers to cause Denial of Service (DoS) via crafted NAS packets. This affects Magma installations up to version 1.8.0, potentially disrupting cellular network core functions.
💻 Affected Systems
- Linux Foundation Magma
📦 What is this software?
Magma by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Magma's 3GPP functionality, potentially affecting cellular network availability for connected devices.
Likely Case
Service instability or crashes in the affected Magma component, leading to intermittent connectivity issues.
If Mitigated
Limited impact with proper network segmentation and monitoring, though service degradation may still occur.
🎯 Exploit Status
Exploitation requires sending crafted NAS packets to the vulnerable component, which typically requires network access to the Magma deployment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9 (commit 08472ba98b8321f802e95f5622fa90fec2dea486)
Vendor Advisory: https://cellularsecurity.org/ransacked
Restart Required: No
Instructions:
1. Update Magma to version 1.9 or later. 2. Apply commit 08472ba98b8321f802e95f5622fa90fec2dea486 if using custom builds. 3. Verify the fix by checking the updated source code.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to Magma components to trusted network segments only
Input Validation
allImplement additional packet validation at network boundaries
🧯 If You Can't Patch
- Implement strict network access controls to limit who can send packets to Magma components
- Deploy intrusion detection systems to monitor for anomalous NAS packet patterns
🔍 How to Verify
Check if Vulnerable:
Check Magma version: if <= 1.8.0, you are vulnerable. Review source code for the vulnerable function in /3gpp/3gpp_24.008_sm_ies.c.Check Version:
magma version or check the Magma build/version information in your deploymentVerify Fix Applied:
Verify Magma version is >= 1.9 or contains commit 08472ba98b8321f802e95f5622fa90fec2dea486. Check that the buffer overflow fix is present in the decode_protocol_configuration_options function.📡 Detection & Monitoring
Log Indicators:
- Unexpected crashes or restarts of Magma 3GPP components
- Error messages related to protocol configuration options parsing
Network Indicators:
- Unusual NAS packet patterns or sizes
- Traffic spikes to Magma components from unexpected sources
SIEM Query:
source="magma" AND ("crash" OR "restart" OR "buffer" OR "overflow")