CVE-2024-24445
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A null dereference vulnerability in OpenAirInterface CN5G AMF (oai-cn5g-amf) version 2.0.0 and earlier occurs when handling unsupported NGAP protocol messages. An attacker with network-adjacent access can trigger a denial of service.
Risk Assessment
An attacker can crash the AMF, disrupting 5G network operations and denying service to legitimate users.
Recommendation
Upgrade to the latest version of OpenAirInterface CN5G AMF that includes a fix. If upgrading is not possible, restrict network access to the AMF to trusted hosts only.
Other vulnerabilities in OpenAirInterface CN5G AMF
See all- CVE-2025-66786High
OpenAirInterface CN5G AMF up to version 2.0.1 has a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to the AMF's SBI interface to launch a denial-of-service attack.
- CVE-2025-65805High
OpenAirInterface CN5G AMF up to version 2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by sending an imsi string longer than 1000 to port N1.
- CVE-2024-24443Medium
An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDU Session Resource Setup Response.
- CVE-2024-24451High
A stack overflow vulnerability exists in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to version 2.0.0. An attacker can repeatedly establish SCTP connections over the N2 interface, causing a system crash.
- CVE-2024-24444High
In OpenAirInterface CN5G AMF up to version 2.0.0, improper file descriptor handling for closed connections was found. An attacker can repeatedly establish SCTP connections via the N2 interface, leading to resource exhaustion and Denial of Service (DoS).
- CVE-2024-24442High
A NULL pointer dereference in the ngap_app::handle_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP message.
Original NVD description (English source)
OpenAirInterface CN5G AMF (oai-cn5g-amf) <= 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is unsupported, OAI indexes into a null function pointer and subsequently dereferences it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS