CVE-2024-24445
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A null dereference vulnerability in OpenAirInterface CN5G AMF (oai-cn5g-amf) version 2.0.0 and earlier occurs when handling unsupported NGAP protocol messages. An attacker with network-adjacent access can trigger a denial of service.
Risk Assessment
An attacker can crash the AMF, disrupting 5G network operations and denying service to legitimate users.
Recommendation
Upgrade to the latest version of OpenAirInterface CN5G AMF that includes a fix. If upgrading is not possible, restrict network access to the AMF to trusted hosts only.
Original NVD description (English source)
OpenAirInterface CN5G AMF (oai-cn5g-amf) <= 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is unsupported, OAI indexes into a null function pointer and subsequently dereferences it.