PT-2024-20392 · Unknown · Oai Epc Federation+1

Published 2024-11-15 · Updated 2024-12-03 · CVE-2024-24426

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenAirInterface Magma version 1.8.0 OAI EPC Federation version 1.2.0

Description The issue allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet. This is due to reachable assertions in the NGAP FIND PROTOCOLIE BY ID function.

Recommendations For OpenAirInterface Magma version 1.8.0, consider disabling the NGAP FIND PROTOCOLIE BY ID function until a patch is available. For OAI EPC Federation version 1.2.0, restrict access to the NGAP packet processing module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-24426

GO-2024-3273

OPENSUSE-SU-2024:14513-1

Affected Products

Oai Epc Federation

Openairinterface Magma

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2024-24426 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24426 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14513-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3273 · Vendor Advisory
• https://github.com/magma/magma · Note
• https://github.com/OPENAIRINTERFACE/openair-epc-fed · Note
• https://cellularsecurity.org/ransacked · Note
• https://suse.com/security/cve/CVE-2024-44625 · Note
• https://suse.com/security/cve/CVE-2024-52308 · Note
• https://suse.com/security/cve/CVE-2024-24425 · Note
• https://suse.com/security/cve/CVE-2024-0793 · Note
• https://t.me/cvedetector/11162 · Telegram Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/CJ6SUNDNOZSHM4PZYYGMBH7233D63JOI · Note
• https://suse.com/security/cve/CVE-2020-8911 · Note
• https://twitter.com/VulmonFeeds/status/1857630224671715741 · Twitter Post