CVE-2024-24427
📋 TL;DR
This vulnerability in Open5GS allows attackers to trigger a reachable assertion in the amf_ue_set_suci function via crafted NAS packets, causing a Denial of Service (DoS) that crashes the service. It affects all deployments running Open5GS versions up to and including 2.6.4. Mobile network operators and organizations using Open5GS for 5G core network functions are impacted.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the Open5GS AMF component, preventing mobile device registration and network access for all users served by that instance.
Likely Case
Intermittent service outages as attackers trigger crashes, requiring manual restarts and causing availability issues for mobile subscribers.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and response to attack attempts.
🎯 Exploit Status
Requires crafting specific NAS packets but no authentication is needed to send them to the AMF interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Open5GS 2.6.5 or later
Vendor Advisory: https://github.com/open5gs/open5gs/releases
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Open5GS services. 3. Update to Open5GS 2.6.5 or later using package manager or source compilation. 4. Restart Open5GS services. 5. Verify service functionality.
🔧 Temporary Workarounds
Network Access Control
LinuxRestrict access to AMF NAS interface to trusted IP addresses only
iptables -A INPUT -p sctp --dport 38412 -s trusted_network -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Open5GS AMF from untrusted networks
- Deploy intrusion detection systems to monitor for crafted NAS packets and alert on attack patterns
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-amfd --versionCheck Version:
open5gs-amfd --versionVerify Fix Applied:
Confirm version is 2.6.5 or higher and monitor for assertion crashes in logs📡 Detection & Monitoring
Log Indicators:
- Assertion failure messages mentioning amf_ue_set_suci
- AMF process crashes with core dumps
- Unexpected service restarts
Network Indicators:
- Unusual SCTP packets to port 38412 with malformed NAS messages
- High volume of NAS registration requests from single sources
SIEM Query:
source="open5gs.log" AND ("assertion" OR "amf_ue_set_suci" OR "SIGABRT")