HPE ArubaCore MME Multiple Vulnerabilities Causing DoS (CVE-2024-24452 to 24457)

Key Information Vulnerability Title HPE Aruba Core Multiple Vulnerabilities Affected Products HPE Aruba Core Software version 11.6 and later under certain configuration settings Vulnerability Details CVE-2024-24452: An invalid memory access when handling the ProtocolID field of E-RAB Release Indication messages in ArubaCore MME v11.6 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload. CVE-2024-24453: An invalid memory access when handling the ProtocolID field of E-RAB Modify Request Handling messages in ArubaCore MME v11.6 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload. CVE-2024-24454: An invalid memory access when handling the ProtocolID field of UE Context Release message in ArubaCore MME v11.6 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload. CVE-2024-24455: A buffer overflow vulnerability in ArubaCore MME Triggered by Malformed E-RAB Release Command NAS PDU causes the ArubaCore MME to immediately crash, potentially due to a buffer overflow. CVE-2024-24456: An invalid memory access when handling the ProtocolID field of E-RAB Setup List Context SLVRES Handling messages in ArubaCore MME v11.6 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload. CVE-2024-24457: An invalid memory access when handling the ProtocolID field of S1Setup Request Handling messages in ArubaCore MME v11.6 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload. CVSS Score Base Score: 5.9 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:A/A:H Discoverer These vulnerabilities were discovered by Bennett, N., Zhu, W., Simon, B., Kennedy, R., Enzi, W., Tramper, P., Butler, K. (2024). Operation Principle Refer to the Operation Principle section for detailed explanation. Affected Versions ArubaCore versions 11.6 and later Solution Upgrade to ArubaCore 11.6 (recommended) In the GUI, navigate to Monitoring -> Utilities -> Process menu, disable the “MME (OLD)” process and enable the “MME” process. Migrate configuration from the “MME” configuration page to the “WMME” (enhanced MME) configuration page. Public Disclosure Policy These vulnerabilities were disclosed through coordinated public disclosure. HPE Aruba Networking is not responsible for any exploitation of these vulnerabilities or for any techniques specifically targeting HPE Aruba networking products.

Goal Reached Thanks to every supporter — we hit 100%!

HPE ArubaCore MME Multiple Vulnerabilities Causing DoS (CVE-2024-24452 to 24457)