SecuriTricks - CVE-2024-24425

Description

Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amf/amf_as.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.

Product(s) Impacted

Product	Versions
Magma	['1.8.0']
OAI EPC Federation	['1.20']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References

https://cellularsecurity.org/ransacked

https://github.com/OPENAIRINTERFACE/openair-epc-fed

https://github.com/magma/magma

CVSS Score

6.5 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

View Vector String

Timeline

Published: Nov. 15, 2024, 7:15 p.m.
Last Modified: Nov. 19, 2024, 5:35 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

CVE-2024-24425