Security Resilience

CVE-2024-24444

Published
21 January 2025
Modified
05 July 2026
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0043 35th percentile
Risk Priority 57 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-24444 is a high-severity Missing Release of File Descriptor or Handle after Effective Lifetime (CWE-775) vulnerability in Cellularsecurity (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-24444 involves improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to version 2.0.0. This vulnerability affects the N2 interface of the software, allowing attackers to trigger a Denial of Service (DoS) by repeatedly establishing SCTP connections. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-775 (Allocation of File Descriptors or Handles Without Limits or Throttling). The issue was published on 2025-01-21.

Remote attackers with network access to the N2 interface can exploit this vulnerability without privileges, authentication, or user interaction due to its low attack complexity. By repeatedly establishing SCTP connections, which are not properly handled upon closure, attackers exhaust available file descriptors. This results in a High-impact availability disruption, preventing the AMF from processing legitimate connections and effectively denying service to the component.

Advisories and further details are available from OpenAirInterface at http://openairinterface.com and Cellular Security research at https://cellularsecurity.org/ransacked. Security practitioners should consult these sources for any recommended mitigations, such as software updates beyond version 2.0.0 or configuration hardening to limit connection rates.

EU & UK References

Vulnerability Data

Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) by repeatedly establishing SCTP connections with the N2 interface.

CWE(s)
CWE-775

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003.001 LSASS Memory Credential Access
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
T1003.006 DCSync Credential Access
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citati…
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-53476Shared CWE-775
CVE-2026-78408Shared CWE-775
CVE-2026-45287Shared CWE-775
CVE-2025-13751Shared CWE-775

Affected Assets

Cellularsecurity
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover unreleased descriptors but does not itself enforce their release.

SA-15 Development Process, Standards, and Tools partial match

Requiring documented secure-development standards and tools can embed mandatory handle-management rules that avoid the weakness.

SA-8 Security and Privacy Engineering Principles partial match

Engineering principles can mandate explicit resource-release patterns that stop descriptor/handle leaks from being coded.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly enforce proper resource release (e.g., file handles) in code.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.8.10 Information deletion partial match
removes

References