CVE-2024-24424

CVE-2024-24424 is a vulnerability involving a reachable assertion in the decode_access_point_name_ie function of Magma versions up to and including 1.8.0. Magma, an open-source software platform for building access gateways and core network functions in cellular networks, is affected. The issue, classified under CWE-400 (Uncontrolled Resource Consumption), enables a Denial of Service (DoS) condition when processing a crafted NAS (Non-Access Stratum) packet. It received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.

The vulnerability can be exploited by unauthenticated attackers with network access to the affected Magma instance. Exploitation requires low complexity and no user interaction, allowing remote attackers to send a specially crafted NAS packet that triggers the assertion failure, resulting in a service crash or denial of service. No privileges, confidentiality, or integrity impacts are possible, but the high availability disruption targets critical cellular network components.

Mitigation is available in Magma version 1.9 via commit 08472ba98b8321f802e95f5622fa90fec2dea486, which addresses the assertion issue. Security practitioners should upgrade to this fixed version and review the advisory at https://cellularsecurity.org/ransacked for additional details on the patch and affected deployments.