CVE-2024-24421
Published: 21 January 2025
Summary
CVE-2024-24421 is a critical-severity Code Injection (CWE-94) vulnerability in Linuxfoundation Magma. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-24421 is a type confusion vulnerability in the nas_message_decode function of Magma versions up to and including 1.8.0. Magma, an open-source platform for building access gateways and core networks in cellular deployments, is affected by this issue, which was published on 2025-01-21.
The vulnerability can be exploited remotely by unauthenticated attackers with low complexity and no user interaction, as reflected in its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By sending a crafted NAS packet, attackers can achieve arbitrary code execution or cause a denial of service. It is classified under CWE-94 (Code Injection).
The issue is fixed in Magma v1.9 via commit 08472ba98b8321f802e95f5622fa90fec2dea486. Additional details are available in the advisory at https://cellularsecurity.org/ransacked.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21840
Vulnerability details
A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via a crafted NAS packet.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated RCE via crafted NAS packet in publicly exposed cellular core component directly matches exploitation of public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the type confusion vulnerability in Magma's nas_message_decode function by identifying, prioritizing, and applying the fix from v1.9 commit 08472ba.
Validates the structure and content of incoming NAS packets to block crafted inputs that trigger the type confusion leading to code execution or DoS.
Implements memory protections like ASLR and DEP to prevent arbitrary code execution from the type confusion vulnerability even if exploited.