CVE-2024-24418
📋 TL;DR
This vulnerability is a buffer overflow in the decode_pdn_address function of the Linux Foundation Magma software, affecting versions up to 1.8.0. It allows attackers to cause a Denial of Service (DoS) by sending a crafted NAS packet, potentially disrupting cellular network services. Systems running vulnerable versions of Magma are affected.
💻 Affected Systems
- Linux Foundation Magma
📦 What is this software?
Magma by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Exploitation could lead to a complete DoS, crashing the Magma service and disrupting cellular network connectivity for users.
Likely Case
Attackers cause intermittent service outages or performance degradation in Magma deployments, impacting network reliability.
If Mitigated
With proper network segmentation and monitoring, impact is limited to isolated service restarts without broader network compromise.
🎯 Exploit Status
Exploitation requires crafting and sending a specific NAS packet, which may involve network access and protocol knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486
Vendor Advisory: https://cellularsecurity.org/ransacked
Restart Required: No
Instructions:
1. Update Magma to version 1.9 or later. 2. Apply the specific commit 08472ba98b8321f802e95f5622fa90fec2dea486 if using a custom build. 3. Verify the update resolves the vulnerability.
🔧 Temporary Workarounds
Network Filtering
allImplement network access controls to block or filter suspicious NAS packets targeting the Magma service.
🧯 If You Can't Patch
- Isolate Magma deployments in segmented network zones to limit attack surface.
- Monitor network traffic for anomalous NAS packets and set up alerts for potential exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check the Magma version; if it is <= 1.8.0, the system is vulnerable. Review logs for crashes in the decode_pdn_address function.Check Version:
magma version or check the software build logs for version information.Verify Fix Applied:
Confirm the Magma version is >= 1.9 or includes commit 08472ba98b8321f802e95f5622fa90fec2dea486. Test with normal NAS traffic to ensure stability.📡 Detection & Monitoring
Log Indicators:
- Log entries indicating crashes or errors in the decode_pdn_address function within /nas/ies/PdnAddress.cpp
Network Indicators:
- Unusual or malformed NAS packets directed at Magma service ports
SIEM Query:
Example: search for 'decode_pdn_address' AND 'error' OR 'crash' in Magma application logs.