CVE-2024-34475
📋 TL;DR
Open5GS versions before 2.7.1 contain a reachable assertion vulnerability in the AMF component that can be triggered by sending specially crafted NAS messages from a UE (User Equipment). This causes the AMF to crash, leading to denial of service for 5G core network services. Organizations running vulnerable Open5GS deployments are affected.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
An attacker could repeatedly crash the AMF component, causing sustained denial of service for 5G core network authentication and mobility management functions, potentially disrupting all UE connections.
Likely Case
Targeted or opportunistic attacks causing intermittent AMF crashes, leading to service disruptions for affected UEs and requiring manual intervention to restart services.
If Mitigated
With proper network segmentation and monitoring, impact is limited to isolated AMF instances with quick detection and recovery possible.
🎯 Exploit Status
Exploitation requires sending NAS messages to the AMF, which UEs normally do during authentication procedures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.1
Vendor Advisory: https://github.com/open5gs/open5gs/compare/v2.7.0...v2.7.1
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Open5GS services. 3. Update to Open5GS 2.7.1 via package manager or source compilation. 4. Restart Open5GS services. 5. Verify AMF is running correctly.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict UE access to AMF component using firewall rules to only allow connections from trusted networks.
iptables -A INPUT -p tcp --dport [AMF_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [AMF_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit which UEs can communicate with the AMF component.
- Deploy monitoring and alerting for AMF process crashes with automated restart capabilities.
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-amfd --version or examine installed package version. If version is below 2.7.1, system is vulnerable.Check Version:
open5gs-amfd --version 2>&1 | grep -o 'version [0-9.]*'Verify Fix Applied:
After patching, verify version is 2.7.1 or higher and monitor AMF logs for stability during normal UE authentication procedures.📡 Detection & Monitoring
Log Indicators:
- AMF process crashes
- Assertion failures in amf/gmm-sm.c
- Unexpected AMF restarts
- Authentication failures from legitimate UEs
Network Indicators:
- Unusual NAS message patterns to AMF
- Repeated authentication attempts from single UE
SIEM Query:
source="open5gs-amf.log" AND ("assertion" OR "crash" OR "segmentation fault")