CVE-2024-24450

Deeper analysis

CVE-2024-24450 is a stack-based buffer overflow (CWE-120) caused by unsafe memcpy handling inside the ngap_handle_pdu_session_resource_setup_response function of OpenAirInterface CN5G AMF versions up to and including 2.0.0. The flaw is triggered when the AMF processes an NGAP PDU Session Resource Setup Response message containing an oversized FailedToSetupList information element.

An attacker who already possesses access to the N2 interface can send a crafted response message that overflows the stack buffer. Successful exploitation results in denial of service against the AMF and may permit remote code execution; the CVSS 5.3 score reflects the required low-privileged network position and high attack complexity.

The two referenced resources point to the OpenAirInterface project site and a cellular-security research page but contain no published patches, configuration work-arounds, or official mitigation guidance. The associated EPSS score has remained flat at 0.1104 with no material post-disclosure increase.