CVE-2024-24429
📋 TL;DR
This vulnerability in Open5GS allows attackers to trigger a denial of service by sending a specially crafted NGAP packet to the nas_eps_send_emm_to_esm function. Systems running Open5GS version 2.6.4 or earlier are affected, potentially disrupting cellular network services.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the Open5GS core network component, affecting all connected cellular devices and services.
Likely Case
Service interruption requiring manual restart of the affected Open5GS component, causing temporary cellular service outages.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and response.
🎯 Exploit Status
Requires crafting a specific NGAP packet but no authentication needed. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5 or later
Vendor Advisory: https://github.com/open5gs/open5gs/releases
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Open5GS to version 2.6.5 or later. 3. Restart Open5GS services. 4. Verify service functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to NGAP interfaces using firewall rules to only trusted sources.
iptables -A INPUT -p sctp --dport 38412 -s trusted_network -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit NGAP interface exposure
- Deploy intrusion detection systems to monitor for anomalous NGAP traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version with: open5gs --versionCheck Version:
open5gs --versionVerify Fix Applied:
Confirm version is 2.6.5 or later and monitor for assertion failures in logs📡 Detection & Monitoring
Log Indicators:
- Assertion failures in Open5GS logs
- Process crashes with nas_eps_send_emm_to_esm function references
Network Indicators:
- Unusual NGAP packet patterns
- Multiple connection attempts to NGAP port 38412
SIEM Query:
source="open5gs.log" AND ("assertion" OR "nas_eps_send_emm_to_esm" OR "crash")