CVE-2024-57519
Published: 28 January 2025
Summary
CVE-2024-57519 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Open5Gs Open5Gs. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 22.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2024-57519 is a denial-of-service vulnerability affecting Open5GS version 2.7.2, an open-source implementation of a 5G core network. The flaw resides in the ogs_dbi_auth_info function within the lib/dbi/subscription.c file, where improper handling allows resource exhaustion. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-400 (Uncontrolled Resource Consumption).
A remote attacker with network access can exploit this vulnerability without authentication or user interaction by sending crafted requests that trigger the faulty function, leading to excessive resource usage and service disruption. Successful exploitation results in high-impact availability loss for the affected Open5GS component, potentially halting core network functions like subscriber authentication.
Mitigation is available via a patch in Open5GS commit 08b9e7c55f72649ef25b5407e7e4d938f0f16531, which addresses the issue in the subscription database interface. Additional details are documented in the Open5GS GitHub issue #3635 and a vulnerability research repository at github.com/f4rs1ght/vuln-research/tree/main/CVE-2024-57519, recommending immediate upgrades for deployments running the vulnerable version.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53607
Vulnerability details
An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2024-57519 enables remote denial of service via crafted input to the ogs_dbi_auth_info function in Open5GS, a network service, by exploiting the application to crash or exhaust it (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely remediation of flaws like the resource exhaustion in ogs_dbi_auth_info, directly addressed by the available Open5GS patch.
SC-5 implements denial-of-service protections specifically against network-based resource exhaustion attacks exploiting crafted requests.
SC-6 ensures resource availability through allocation and monitoring mechanisms to mitigate uncontrolled consumption triggered by the vulnerable function.