CVE-2024-24427

CVE-2024-24427 is a reachable assertion vulnerability in the `amf_ue_set_suci` function within Open5GS versions up to and including 2.6.4. This flaw affects the Access and Mobility Management Function (AMF) component of the open-source 5G core network stack, enabling attackers to trigger a denial-of-service (DoS) condition through a specially crafted Non-Access Stratum (NAS) packet. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-617 (Reachable Assertion).

Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a malicious NAS packet to an affected Open5GS deployment, an attacker can cause the assertion to fail, leading to a crash of the AMF process and disrupting 5G core network services, resulting in a high-impact availability denial.

Mitigation details and further advisories are available at https://cellularsecurity.org/ransacked, published in relation to this vulnerability.