CVE-2024-56921
📋 TL;DR
This vulnerability in Open5gs AMF allows remote attackers to cause a denial of service by sending specially crafted InitialUEMessage or Registration requests at specific times. The crash occurs due to incorrect error handling in the gmm_state_exception() function when processing Nausf_UEAuthentication_Authenticate responses. This affects all deployments running vulnerable versions of Open5gs.
💻 Affected Systems
- Open5gs
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete AMF service disruption leading to 5G network unavailability for affected subscribers, potentially cascading to other network functions.
Likely Case
Intermittent AMF crashes causing service degradation, dropped connections, and failed authentication attempts for 5G users.
If Mitigated
Limited impact with proper monitoring and rapid restart capabilities, though service interruptions may still occur.
🎯 Exploit Status
Exploitation requires timing-specific attacks but no authentication. Attackers need to understand 5G protocol specifics.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit f780f9af45c27b6f49987d96ba71dedb3dd85840 and later versions
Vendor Advisory: https://github.com/open5gs/open5gs/issues/3608
Restart Required: Yes
Instructions:
1. Update Open5gs to latest version or apply commit f780f9af45c27b6f49987d96ba71dedb3dd85840
2. Recompile Open5gs from source
3. Restart AMF service
4. Verify AMF is running without crashes
🔧 Temporary Workarounds
Rate limiting UE connections
allImplement connection rate limiting to reduce attack surface
# Configure firewall or load balancer to limit connections per source IP
# Example iptables: iptables -A INPUT -p tcp --dport 38412 -m limit --limit 10/min -j ACCEPT
🧯 If You Can't Patch
- Implement network segmentation to isolate AMF from untrusted networks
- Deploy redundant AMF instances with load balancing to maintain service during crashes
🔍 How to Verify
Check if Vulnerable:
Check Open5gs version: open5gs-amfd --version. If version is 2.7.2 or earlier without the fix commit, system is vulnerable.Check Version:
open5gs-amfd --versionVerify Fix Applied:
Monitor AMF logs for crashes after applying patch. Test with normal UE registration traffic.📡 Detection & Monitoring
Log Indicators:
- AMF process crashes
- gmm_state_exception errors in logs
- UE authentication failures with specific timing patterns
Network Indicators:
- Unusual spike in InitialUEMessage packets
- Registration requests with specific timing patterns
- AMF service port becoming unresponsive
SIEM Query:
source="open5gs.logs" AND ("AMF crashed" OR "gmm_state_exception" OR "UEAuthentication_Authenticate error")