CVE-2024-24423
📋 TL;DR
A buffer overflow vulnerability in Magma's decode_esm_message_container function allows attackers to cause Denial of Service via crafted NAS packets. This affects all systems running Magma <=1.8.0, particularly cellular network infrastructure deployments.
💻 Affected Systems
- Linux Foundation Magma
📦 What is this software?
Magma by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Magma components, potentially affecting cellular network availability for connected devices.
Likely Case
DoS against specific Magma instances causing localized service degradation.
If Mitigated
Limited impact with proper network segmentation and monitoring.
🎯 Exploit Status
Requires ability to send crafted NAS packets to vulnerable Magma instances.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9 (commit 08472ba98b8321f802e95f5622fa90fec2dea486)
Vendor Advisory: https://cellularsecurity.org/ransacked
Restart Required: No
Instructions:
1. Update Magma to version 1.9 or later. 2. Apply commit 08472ba98b8321f802e95f5622fa90fec2dea486 if using custom builds. 3. Verify the fix by checking the updated EsmMessageContainer.cpp file.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Magma services to trusted sources only.
iptables -A INPUT -p tcp --dport <magma_port> -s <trusted_network> -j ACCEPT
iptables -A INPUT -p tcp --dport <magma_port> -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can send packets to Magma services.
- Deploy intrusion detection systems to monitor for anomalous NAS packet patterns.
🔍 How to Verify
Check if Vulnerable:
Check Magma version: magma version | grep 'Magma version'Check Version:
magma versionVerify Fix Applied:
Verify version is >=1.9 or check EsmMessageContainer.cpp contains the fix commit hash.📡 Detection & Monitoring
Log Indicators:
- Magma service crashes
- Abnormal termination of decode_esm_message_container processes
- Memory allocation errors in Magma logs
Network Indicators:
- Unusual NAS packet patterns
- High volume of malformed packets to Magma ports
SIEM Query:
source="magma.log" AND ("segmentation fault" OR "buffer overflow" OR "EsmMessageContainer")