PT-2025-2382 · Unknown · Openairinterface Cn5G Amf

Published 2025-01-21 · Updated 2025-01-22 · CVE-2024-24443

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: OpenAirInterface CN5G AMF (oai-cn5g-amf) versions up to v2.0.0

Description: The issue is caused by an uninitialized pointer dereference in the ngap handle pdu session resource setup response routine. This allows attackers to cause a Denial of Service (DoS) via a crafted PDU Session Resource Setup Response.

Recommendations: For versions up to v2.0.0, consider disabling the ngap handle pdu session resource setup response routine as a temporary workaround until a patch is available. Restrict access to the vulnerable routine to minimize the risk of exploitation. Avoid using crafted PDU Session Resource Setup Responses in the affected routine until the issue is resolved.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2024-24443

Affected Products

Openairinterface Cn5G Amf

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-24443 · Security Note
• https://twitter.com/CVEnew/status/1881933353810542756 · Twitter Post
• https://cellularsecurity.org/ransacked · Note
• https://twitter.com/VulmonFeeds/status/1882010528207274193 · Twitter Post
• http://openairinterface.com · Note