CVE-2024-24450 is a stack-based buffer overflow vulnerability identified in the OpenAirInterface CN5G Access and Mobility Management Function (AMF) software, versions up to and including 2.0.0. The flaw exists in the ngap_handle_pdu_session_resource_setup_response routine, which processes PDU Session Resource Setup Response messages received over the N2 interface. Specifically, the vulnerability arises when the FailedToSetupList Information Element (IE) within the response message is crafted with a size larger than expected, causing a memcpy operation to overflow a stack buffer. This overflow can lead to memory corruption, resulting in denial of service conditions by crashing the AMF or, in some cases, enabling remote code execution. Exploitation requires the attacker to have network-level access to the N2 interface, which connects the AMF to the RAN (Radio Access Network). The attack complexity is high due to the need to craft precise malformed messages, but no user interaction is required. The vulnerability is classified under CWE-120 (Classic Buffer Overflow). The CVSS v3.1 base score is 5.3, reflecting a medium severity primarily due to the availability impact and the requirement for some privileges and high attack complexity. No patches or known exploits are currently reported, but the vulnerability poses a significant risk to 5G core network infrastructure relying on OpenAirInterface CN5G AMF.

The primary impact of CVE-2024-24450 is on the availability of the 5G core network's AMF component, which is critical for managing mobility and session states in 5G networks. Successful exploitation can cause denial of service, disrupting network connectivity and session management for subscribers, potentially leading to widespread service outages. In worst-case scenarios, remote code execution could allow attackers to take control of the AMF, enabling further attacks such as interception, manipulation of subscriber data, or lateral movement within the telecom network. This could undermine the integrity and confidentiality of the 5G network. Given the central role of the AMF in 5G architecture, such disruptions could affect telecom operators, service providers, and their customers, impacting critical communications and services. The requirement for access to the N2 interface limits the attack surface to entities with network-level access, but insider threats or compromised network segments could exploit this vulnerability. The medium CVSS score reflects the balance between impact and exploitation complexity, but the strategic importance of 5G infrastructure elevates the overall risk.

Organizations should implement strict network segmentation and access controls to limit access to the N2 interface only to trusted and authenticated network elements. Deploying network monitoring and anomaly detection systems to identify unusual or malformed NGAP messages can help detect exploitation attempts early. Since no official patches are currently available, operators should consider applying temporary mitigations such as filtering or rate-limiting suspicious PDU Session Resource Setup Response messages at the network edge. Updating to newer versions of OpenAirInterface CN5G AMF once patches are released is critical. Additionally, conducting regular security assessments and penetration testing focused on the 5G core network components can help identify and remediate similar vulnerabilities proactively. Employing defense-in-depth strategies, including intrusion prevention systems (IPS) tailored for telecom protocols, will further reduce risk. Maintaining close coordination with vendors and security communities for timely vulnerability disclosures and patches is essential.