CVE-2024-34043

Executive Summary

CVE-2024-34043 is a segmentation violation vulnerability in the O-RAN RICAPP kpimon-go I-Release component. The flaw is triggered by a specially crafted E2AP-PDU message, leading to a NULL pointer dereference (CWE-476) that causes the application to crash. This denial-of-service (DoS) condition can be exploited by an attacker with network access to the RAN Intelligent Controller (RIC) near-real-time (near-RT) interface. No public exploit code or proof-of-concept is available, and the vendor has not yet released a patch. The vulnerability affects the O-RAN ecosystem, specifically the kpimon-go implementation used for key performance indicator (KPI) monitoring in 5G networks.

Supply Chain & Package Security

This vulnerability is in a Go-based component (kpimon-go) of the O-RAN software stack. The package is not distributed via public registries like NPM or PyPI, but it is part of the O-RAN open-source project. Organizations using O-RAN near-RT RIC deployments should verify the integrity of their kpimon-go binary and monitor for updates from the O-RAN Software Community (OSC).

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged
• Confidentiality Impact (C): None
• Integrity Impact (I): None
• Availability Impact (A): High
• Base Score Estimate: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Threat Level: High – The vulnerability allows remote unauthenticated attackers to crash the kpimon-go service, disrupting KPI monitoring in O-RAN networks.

Deep Dive & Mechanics

The kpimon-go component is part of the O-RAN near-RT RIC, responsible for collecting and processing performance metrics from E2 nodes (e.g., gNBs). It communicates using the E2 Application Protocol (E2AP) over SCTP. The vulnerability resides in the E2AP-PDU message parsing logic.

When a malformed E2AP-PDU message is received, the code fails to validate a pointer before dereferencing it, leading to a segmentation fault. The crash is caused by a NULL pointer dereference (CWE-476) in the ASN.1 decoding or message handling routine. An attacker can send a crafted E2AP-PDU message to the kpimon-go service, causing it to terminate unexpectedly. This results in a denial-of-service condition, preventing the collection of KPI data and potentially affecting network visibility and automation.

The vulnerable code path is likely in the e2ap_pdu handling function, where a pointer to a message field is used without checking for NULL after decoding. The fix would involve adding proper NULL checks before dereferencing pointers in the E2AP-PDU processing logic.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

func handleE2APPDU(pdu *E2APPDU) {
    // No NULL check on pdu or its fields
    processKPI(pdu.SubscriptionID) // Segmentation fault if pdu.SubscriptionID is nil
}

Patched Code (Conceptual):

func handleE2APPDU(pdu *E2APPDU) {
    if pdu == nil || pdu.SubscriptionID == nil {
        log.Error("Invalid E2AP-PDU: nil pointer")
        return
    }
    processKPI(pdu.SubscriptionID)
}

The patch adds nil checks before dereferencing pointers in the E2AP-PDU message structure.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Network access to the O-RAN near-RT RIC interface (typically SCTP port 36422)
• Knowledge of E2AP protocol structure

Exploitation Steps:

1. Craft a malformed E2AP-PDU message with a NULL pointer in a critical field (e.g., SubscriptionID).
2. Send the message to the kpimon-go service using a raw SCTP socket.
3. Observe the service crash via segmentation violation.

Example Python script (conceptual):

import socket
import struct

# Craft a malformed E2AP-PDU (simplified)
def craft_malformed_e2ap():
    # E2AP header + NULL pointer in SubscriptionID
    payload = b'\x00\x01\x00\x00'  # Placeholder
    return payload

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_SCTP)
sock.connect(('target_ric_ip', 36422))
sock.send(craft_malformed_e2ap())
sock.close()

Blue Team (Defensive)

Detection:

• Monitor for SCTP connections to port 36422 from unexpected sources.
• Look for repeated connection attempts or malformed E2AP messages.
• Use the Sigma rule below to detect crashes in kpimon-go logs.

Mitigation:

• Restrict network access to the near-RT RIC interface using firewall rules.
• Implement input validation and fuzzing for E2AP message parsing.
• Apply vendor patches when available.

Indicators of Compromise (IOCs)

• Network: SCTP traffic to port 36422 with malformed E2AP-PDU payloads.
• Logs: Segmentation fault errors in kpimon-go logs (e.g., "SIGSEGV", "panic: runtime error: invalid memory address or nil pointer dereference").
• Process: kpimon-go process crash and restart cycles.
• File: Core dump files generated by the system.

Detection Engineering

YARA Rule

rule CVE_2024_34043_kpimon_go_crash {
    meta:
        description = "Detects kpimon-go crash logs indicating CVE-2024-34043 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-34043"
    strings:
        $s1 = "SIGSEGV" ascii nocase
        $s2 = "nil pointer dereference" ascii nocase
        $s3 = "kpimon-go" ascii nocase
        $s4 = "panic" ascii nocase
    condition:
        any of ($s1, $s2) and $s3 and $s4
}

Sigma Rule

title: Detection of kpimon-go Crash via CVE-2024-34043
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects segmentation violation in kpimon-go logs
author: Valters IT
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "SIGSEGV"
        - "nil pointer dereference"
        - "kpimon-go"
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert sctp any any -> any 36422 (msg:"CVE-2024-34043 Potential kpimon-go E2AP-PDU Exploit"; flow:to_server; content:"|00 01 00 00|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Vendor Patch: Apply the official fix from O-RAN Software Community when released.
2. Workaround: Implement input validation in the E2AP-PDU handler to check for NULL pointers before dereferencing.
3. Network Segmentation: Restrict access to the near-RT RIC interface to trusted management networks only.
4. Monitoring: Deploy the provided YARA and Sigma rules to detect exploitation attempts.
5. Fuzzing: Conduct fuzz testing on E2AP message parsing to identify similar vulnerabilities.

Valters IT
Securing the Future of Open RAN