Minamikotor1

FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2 SETUP REQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists in the cleanup path and enforces this via assert(). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by simply completing an SCTP handshake and immediately disconnecting, without sending any E2AP message.

FlexRIC v2.0.0 crashes when receiving a RIC SUBSCRIPTION RESPONSE with an unknown ric id that has no corresponding pending event. The near-RT RIC uses assert() to enforce the existence of a pending event during response processing. A remote unauthenticated attacker can send a forged RIC SUBSCRIPTION RESPONSE to the near-RT RIC (port 36421) to cause SIGABRT in Debug builds or NULL pointer dereference (SIGSEGV) in Release builds.

FlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. A remote unauthenticated attacker can send a valid E2AP PDU containing an unexpected number of IEs (e.g., an E2setupRequest with extra optional fields) to crash the near-RT RIC (port 36421) or iApp (port 36422) via SIGABRT. The code asserts exact IE counts rather than validating against protocol-specified ranges.

FlexRIC v2.0.0 contains a reachable assertion in e2ap recv sctp msg() (src/lib/ep/e2ap ep.c). The function allocates a fixed 32KB receive buffer and enforces assert(rc < len) on the sctp recvmsg() return value. A remote unauthenticated attacker can send a single SCTP message with payload >= 32,768 bytes to crash the near-RT RIC, iApp, E2 Agent, or xApp process via SIGABRT. No valid E2AP PDU is required. All four SCTP endpoint types (ports 36421 and 36422) share this vulnerable code path. In Release builds (NDEBUG), the stripped assertion leads to a signed-to-unsigned integer overflow and potential out-of-bounds read.

FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC INDICATION message with a ran func id that does not exist in its registry. The lookup returns NULL, triggering assert() in Debug builds (SIGABRT) or NULL pointer dereference in Release builds (SIGSEGV). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by sending a crafted RIC INDICATION with an arbitrary ran func id value.

**Name of the Vulnerable Software and Affected Versions** OpenAirInterface5G version 2.4.0 **Description** An issue exists in the E2SM-KPM RAN Function's PRB utilization metric calculation within the `nr-softmodem` component. The functions `fill RRU PrbTotDl()` and `fill RRU PrbTotUl()` compute PRB usage percentages by dividing by the difference of two consecutive `total prb aggregate` samples without verifying if the divisor is zero. A malicious xApp can trigger this by sending a high volume of `E42 RIC SUBSCRIPTION REQUESTs` via the FlexRIC iApp on port 36422/SCTP, causing the E2 Agent to generate KPM Indication reports at a high frequency. If two consecutive sampling intervals produce identical PRB aggregate values, a division by zero occurs, triggering a SIGFPE (floating-point exception) and crashing the 5G base station process. This leads to a complete interruption of 5G cell service for all connected User Equipment (UE). No authentication is required to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq xapp ric gen id() in src/ric/iApp/xapp ric id.c compares m0->xapp id against itself (m0->xapp id) instead of the other argument (m1->xapp id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42 RIC SUBSCRIPTION DELETE REQUEST with a matching ric gen id. This breaks multi-tenant isolation in any deployment with multiple xApps sharing the same RIC.

**Name of the Vulnerable Software and Affected Versions** FlexRIC version 2.0.0 **Description** A flaw allows a single SCTP connection to bind multiple `xapp ids` by sending multiple `E42 SETUP REQUESTs`. Upon disconnection, the system only cleans up resources for the first registered `xapp id`, leaving subsequent `xapp ids` and their subscriptions as stale entries. A remote attacker can exploit this to leak subscription state in the iApp, which may lead to state corruption or resource exhaustion over time. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.