CVE-2024-24444
📋 TL;DR
This vulnerability in OpenAirInterface CN5G AMF allows attackers to cause denial of service by repeatedly establishing SCTP connections with the N2 interface. The improper handling of closed connections leads to resource exhaustion, affecting all deployments using vulnerable versions of oai-cn5g-amf.
💻 Affected Systems
- OpenAirInterface CN5G AMF (oai-cn5g-amf)
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the AMF component, preventing 5G network access for all users served by the affected instance.
Likely Case
Degraded performance and intermittent service outages as connection resources are exhausted.
If Mitigated
Minimal impact with proper network segmentation and connection rate limiting in place.
🎯 Exploit Status
Attack requires ability to establish SCTP connections to the N2 interface, which is typically network-accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.0.1 or later
Vendor Advisory: http://openairinterface.com
Restart Required: Yes
Instructions:
1. Download latest version from OpenAirInterface repository. 2. Replace vulnerable oai-cn5g-amf component. 3. Restart AMF service.
🔧 Temporary Workarounds
Implement SCTP connection rate limiting
LinuxLimit the rate of incoming SCTP connections using firewall rules or network controls
iptables -A INPUT -p sctp --dport 38412 -m limit --limit 10/min -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to N2 interface
- Deploy intrusion prevention system with SCTP connection flood detection
🔍 How to Verify
Check if Vulnerable:
Check oai-cn5g-amf version: if version <= 2.0.0 and N2 interface is exposed, system is vulnerable.Check Version:
oai-cn5g-amf --versionVerify Fix Applied:
Verify oai-cn5g-amf version is >= 2.0.1 and monitor for connection exhaustion events.📡 Detection & Monitoring
Log Indicators:
- Unusually high SCTP connection establishment rates
- AMF service restart events
- Connection resource exhaustion warnings
Network Indicators:
- High volume of SCTP INIT packets to port 38412
- Repeated connection attempts from single sources
SIEM Query:
source="amf.log" AND ("connection limit" OR "resource exhausted" OR "SCTP flood")