CVE-2024-24419
📋 TL;DR
A buffer overflow vulnerability in Magma's decode_traffic_flow_template_packet_filter function allows attackers to cause denial of service via crafted NAS packets. This affects Magma cellular core network software users running vulnerable versions, potentially disrupting mobile network services.
💻 Affected Systems
- Linux Foundation Magma
📦 What is this software?
Magma by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Magma-based cellular networks, affecting all connected mobile devices and services.
Likely Case
Service instability or crashes in affected Magma components, leading to temporary network outages.
If Mitigated
Limited impact with proper network segmentation and monitoring, potentially only affecting isolated components.
🎯 Exploit Status
Requires knowledge of 3GPP NAS protocol and ability to send crafted packets to vulnerable interfaces.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9 (commit 08472ba98b8321f802e95f5622fa90fec2dea486)
Vendor Advisory: https://cellularsecurity.org/ransacked
Restart Required: Yes
Instructions:
1. Update Magma to version 1.9 or later. 2. Apply commit 08472ba98b8321f802e95f5622fa90fec2dea486 if using custom build. 3. Restart Magma services.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to Magma NAS packet interfaces to trusted sources only
iptables -A INPUT -p tcp --dport <magma_port> -s <trusted_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport <magma_port> -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to Magma components
- Deploy intrusion detection systems monitoring for anomalous NAS packets
🔍 How to Verify
Check if Vulnerable:
Check Magma version: magma version | grep 'Magma version'Check Version:
magma versionVerify Fix Applied:
Verify version is >=1.9 or commit 08472ba98b8321f802e95f5622fa90fec2dea486 is present📡 Detection & Monitoring
Log Indicators:
- Magma service crashes
- Memory corruption errors in system logs
- Abnormal packet processing errors
Network Indicators:
- Unusual NAS packet patterns
- Traffic spikes to Magma NAS interfaces
- Connection attempts from unexpected sources
SIEM Query:
source="magma" AND ("segmentation fault" OR "buffer overflow" OR "service crash")