CVE-2024-24421
📋 TL;DR
A type confusion vulnerability in Magma's NAS message decoding function allows attackers to execute arbitrary code or cause denial of service via specially crafted NAS packets. This affects Magma cellular core network software versions 1.8.0 and earlier. Attackers can exploit this remotely without authentication.
💻 Affected Systems
- Magma cellular core network software
📦 What is this software?
Magma by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution leading to complete system compromise, data exfiltration, and lateral movement within the cellular network infrastructure.
Likely Case
Denial of service causing service disruption in the cellular core network, potentially affecting subscriber connectivity and network operations.
If Mitigated
Limited impact if network segmentation and proper access controls prevent external attackers from reaching vulnerable interfaces.
🎯 Exploit Status
Exploitation requires crafting malicious NAS packets but doesn't require authentication. The type confusion vulnerability could lead to memory corruption and code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9 (specifically commit 08472ba98b8321f802e95f5622fa90fec2dea486)
Vendor Advisory: https://cellularsecurity.org/ransacked
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Update Magma to version 1.9 or later. 3. Apply commit 08472ba98b8321f802e95f5622fa90fec2dea486 if using source build. 4. Restart Magma services. 5. Verify functionality and monitor for issues.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to Magma NAS interfaces using firewall rules to only trusted sources.
iptables -A INPUT -p tcp --dport <magma_port> -s <trusted_network> -j ACCEPT
iptables -A INPUT -p tcp --dport <magma_port> -j DROP
Rate Limiting
linuxImplement rate limiting on NAS packet processing to reduce DoS impact.
iptables -A INPUT -p tcp --dport <magma_port> -m limit --limit 100/minute --limit-burst 200 -j ACCEPT
🧯 If You Can't Patch
- Implement strict network access controls to limit which devices can send NAS packets to vulnerable systems.
- Deploy intrusion detection systems to monitor for anomalous NAS packet patterns and potential exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check Magma version: magma version | grep 'Magma version' and compare to 1.8.0 or earlier.Check Version:
magma version | grep 'Magma version'Verify Fix Applied:
Verify version is 1.9 or later: magma version | grep 'Magma version' and confirm commit includes 08472ba98b8321f802e95f5622fa90fec2dea486.📡 Detection & Monitoring
Log Indicators:
- Unusual NAS message decoding errors
- Memory access violation logs
- Service crashes in magma-nasd process
Network Indicators:
- Malformed NAS packets with unusual type fields
- High volume of NAS packets from single sources
- NAS packets with crafted type confusion patterns
SIEM Query:
source="magma" AND ("nas_message_decode" OR "type confusion" OR "memory violation")