FlexRIC vulnerabilities

FlexRIC v2.0.0 allows binding multiple xapp_ids to a single SCTP connection by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first registered xapp_id's resources are cleaned up, leaving stale entries. A remote attacker can exploit this to leak subscription state in the iApp, potentially causing resource exhaustion or state corruption.

FlexRIC v2.0.0 trusts the xapp_id field from E42 messages without binding it to the sender's SCTP association. A remote unauthenticated attacker can impersonate any xApp by sending requests to iApp (port 36422), causing misrouted responses and potentially crashing the victim xApp, RIC, or iApp due to state inconsistencies in the red-black tree.

In FlexRIC v2.0.0, an authorization bypass vulnerability exists in the iApp's xApp isolation mechanism. The function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id.

FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate xapp_ids. The iApp (port 36422) crashes when attempting to register a duplicate ID. A remote attacker can trigger this by repeatedly connecting and requesting new xApp registrations.

FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a non-existent ran_func_id. Debug builds assert (SIGABRT), Release builds NULL pointer dereference (SIGSEGV). A remote unauthenticated attacker can send a crafted message to port 36421.

FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence over SCTP to crash the process via SIGABRT.

FlexRIC v2.0.0 has a reachable assertion in e2ap_recv_sctp_msg(). Sending a single SCTP message with payload >= 32768 bytes crashes near-RT RIC, iApp, E2 Agent, or xApp via SIGABRT. Release builds suffer integer overflow.

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup returns NULL, causing assert (SIGABRT) in Debug or dereference (SIGSEGV) in Release. A remote unauthenticated attacker can send a request to port 36422.

FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC. A remote unauthenticated attacker can send a decodable E2AP PDU of such a type (e.g., E2nodeConfigurationUpdate) to crash the near-RT RIC process (port 36421) via SIGABRT.

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field. The E42 layer decoder accepts this as valid, but the E2AP encoder asserts a non-empty constraint when forwarding the request. A remote unauthenticated attacker can crash the iApp process (port 36422) via SIGABRT by exploiting this cross-layer validation mismatch.

FlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_REQUEST from the same or spoofed E2 Node. The iApp registry enforces node ID uniqueness via assert(), allowing a remote unauthenticated attacker to crash the iApp process via SIGABRT.

FlexRIC v2.0.0 has a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert(). A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp process (port 36422) via SIGABRT. Since iApp and the near-RT RIC share one process, this terminates the entire RIC service and disconnects all E2 Nodes and xApps.

FlexRIC v2.0.0 uses hardcoded assertions to validate IE counts in decoded E2AP messages. A remote unauthenticated attacker can crash the near-RT RIC or iApp via SIGABRT by sending a valid PDU with unexpected IE count.

FlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no pending event. The near-RT RIC uses assert() to enforce a pending event. A remote unauthenticated attacker can send a forged response to port 36421, causing SIGABRT (Debug) or NULL pointer dereference (SIGSEGV) in Release builds.

FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists and enforces this via assert(). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by completing an SCTP handshake and immediately disconnecting without sending any E2AP message.