CVE-2024-24443
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDU Session Resource Setup Response.
Risk Assessment
The risk is that an attacker can remotely crash the AMF system, disrupting 5G network operations and potentially preventing user session handling.
Recommendation
It is recommended to immediately upgrade oai-cn5g-amf to a version later than 2.0.0, which includes a fix for the uninitialized pointer issue.
Original NVD description (English source)
An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDU Session Resource Setup Response.