Zhongnan Luo

A remote unauthenticated attacker can cause the near-RT RIC to crash on port 36421. The issue occurs when an SCTP (Stream Control Transmission Protocol) association is closed before an `E2 SETUP REQUEST` is sent. The system incorrectly assumes a mapping between the SCTP association and the E2 node always exists during the cleanup path and enforces this using an `assert()` function, leading to a crash if the mapping is missing. This can be triggered by completing an SCTP handshake and disconnecting immediately without sending any E2AP messages.

The software crashes when it receives a RIC SUBSCRIPTION RESPONSE containing an unknown `ric id` that lacks a corresponding pending event. The near-RT RIC employs the `assert()` function to verify the existence of a pending event during response processing. A remote unauthenticated attacker can send a forged RIC SUBSCRIPTION RESPONSE to the near-RT RIC on port 36421, resulting in a SIGABRT (abnormal termination) in Debug builds or a NULL pointer dereference (SIGSEGV), which occurs when a program attempts to access a memory location that is not mapped, in Release builds.

The iApp message dispatcher contains a reachable assertion. The dispatcher uses the `assert()` function to validate incoming E2AP messages against a 9-entry whitelist. A remote unauthenticated attacker can send a decodable E2AP PDU with a message type not present in the whitelist, triggering a SIGABRT (a signal sent to a process to force it to abort) and crashing the iApp process on port 36422. Because iApp and the near-RT RIC share a single process, this action terminates the entire RIC service, resulting in the disconnection of all xApps and E2 Nodes.

The iApp process on port 36421 crashes when it receives a duplicate E2 SETUP REQUEST from the same or a spoofed E2 Node. This occurs because the iApp registry uses an `assert()` function to enforce node ID uniqueness instead of implementing a controlled rejection. A remote unauthenticated attacker can trigger a SIGABRT (a signal sent to a process to force it to abort) by sending two E2 SETUP REQUESTs with identical E2 node configurations.

A validation mismatch between layers allows a remote unauthenticated attacker to crash the iApp process on port 36422 via SIGABRT. The issue occurs when the iApp receives an 'E42 RIC SUBSCRIPTION REQUEST' containing an empty `ricEventTriggerDefinition` field; while the E42 layer decoder accepts the empty field as valid, the E2AP encoder enforces a non-empty constraint when forwarding the request, leading to the crash.

The near-RT RIC contains reachable `assert(0)` calls within stub message handlers for E2AP message types that are whitelisted but not yet implemented. A remote unauthenticated attacker can cause the near-RT RIC process on port 36421 to crash via SIGABRT by sending a decodable E2AP PDU of an unimplemented type, such as `E2nodeConfigurationUpdate`. The message successfully passes whitelist validation but triggers an unconditional assertion in the handler.

A remote unauthenticated attacker can cause the iApp process on port 36422 to crash by sending an `E42 RIC SUBSCRIPTION REQUEST` that references a non-existent E2 Node. This occurs because the lookup function returns NULL, leading to a SIGABRT in Debug builds due to an `assert()` or a SIGSEGV in Release builds due to a null pointer dereference. The attack is triggered by providing an arbitrary `global e2 node id`.

A reachable assertion in the `e2ap create pdu()` function is triggered when ASN.1 PER (Packed Encoding Rules, a binary encoding format for ASN.1 data) decoding fails. A remote unauthenticated attacker can send a non-PER byte sequence over SCTP to the near-RT RIC on port 36421 or the iApp on port 36422, causing the process to crash via SIGABRT. This occurs before any protocol-level validation takes place and affects E2AP protocol versions v1.01, v2.03, and v3.01.

The near-RT RIC crashes when it receives a RIC INDICATION message containing a `ran func id` that is not present in its registry. This occurs because the lookup process returns NULL, which leads to an assert() failure in Debug builds (SIGABRT) or a NULL pointer dereference in Release builds (SIGSEGV). A remote unauthenticated attacker can trigger this crash by sending a specially crafted RIC INDICATION message with an arbitrary `ran func id` value to port 36421.

An issue exists where a `uint16 t` counter is used for `xapp id` assignment but is stored in `uint32 t` message fields. After more than 65,530 E42 SETUP REQUESTs, the 16-bit counter wraps around, resulting in duplicate `xapp ids`. This causes the iApp (port 36422) to crash when it attempts to register a duplicate ID within its internal data structure. A remote attacker can trigger this crash by repeatedly connecting and requesting new xApp registrations.

An issue exists in the E2SM-KPM RAN Function's PRB utilization metric calculation within the `nr-softmodem` component. The functions `fill RRU PrbTotDl()` and `fill RRU PrbTotUl()` compute PRB usage percentages by dividing by the difference of two consecutive `total prb aggregate` samples without verifying if the divisor is zero. A malicious xApp can trigger this by sending a high volume of `E42 RIC SUBSCRIPTION REQUESTs` via the FlexRIC iApp on port 36422/SCTP, causing the E2 Agent to generate KPM Indication reports at a high frequency. If two consecutive sampling intervals produce identical PRB aggregate values, a division by zero occurs, triggering a SIGFPE (floating-point exception) and crashing the 5G base station process. This leads to a complete interruption of 5G cell service for all connected User Equipment (UE). No authentication is required to exploit this issue.

An authorization bypass exists in the iApp xApp isolation mechanism. The function `eq xapp ric gen id()` in src/ric/iApp/xapp ric id.c incorrectly compares `m0->xapp id` against itself instead of comparing it to `m1->xapp id`, which ignores the xApp identity dimension. Consequently, a malicious xApp connected to the iApp via port 36422 can delete subscriptions belonging to any other xApp by sending an E42 RIC SUBSCRIPTION DELETE REQUEST with a matching `ric gen id`. This flaw compromises multi-tenant isolation in deployments where multiple xApps share the same RIC.

An issue exists where the software trusts the `xapp id` field from E42 message payloads without binding it to the sender's SCTP association. The validation function `valid xapp id()` only verifies that the value is within the assigned range. A remote unauthenticated attacker can impersonate any xApp by specifying a target `xapp id` in requests sent to the iApp endpoint on port 36422. This leads to responses being misrouted to the victim xApp, which can cause the victim xApp, the RIC, or the iApp to crash due to state inconsistencies in the red-black tree data structure, a self-balancing binary search tree used for efficient data storage and retrieval.