PT-2025-2381 · Unknown · Openairinterface Cn5G Amf

Published 2025-01-21 · Updated 2025-01-24 · CVE-2024-24442

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: OpenAirInterface CN5G AMF (oai-cn5g-amf) versions up to v2.0.0

Description: A NULL pointer dereference in the ngap app::handle receive routine allows attackers to cause a Denial of Service (DoS) via a crafted NGAP message. This issue can be exploited by attackers to disrupt service.

Recommendations: For versions up to v2.0.0, as a temporary workaround, consider disabling the ngap app::handle receive routine until a patch is available. Restrict access to the vulnerable routine to minimize the risk of exploitation. Avoid using crafted NGAP messages in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2024-24442

Affected Products

Openairinterface Cn5G Amf

References · 7

• 🔥 https://cellularsecurity.org/ransacked · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24442 · Security Note
• https://t.me/cvedetector/16036 · Telegram Post
• https://twitter.com/CVEnew/status/1881933353001083232 · Twitter Post
• https://t.me/cvenotify/108165 · Telegram Post
• https://t.me/cvenotify/108526 · Telegram Post
• http://openairinterface.com · Note