CVE-2024-34044

Executive Summary

CVE-2024-34044 is a NULL pointer dereference vulnerability in the O-RAN E2T (E2 Termination) component of the O-RAN I-Release. The flaw resides in the buildPrometheusList function, where the peerInfo pointer can be NULL, leading to a potential denial-of-service (DoS) condition. This vulnerability affects the O-RAN ecosystem, which is critical for open radio access network deployments. No CVSS score, EPSS score, or public exploit code has been released, but the risk is elevated due to the lack of a patch and the potential for remote exploitation in unsecured environments.

Supply Chain & Package Security

This vulnerability is not in a standard package manager (NPM, PyPI, Go, Ruby) but in the O-RAN software distribution. Organizations using O-RAN I-Release should verify the integrity of their E2T component and monitor for updates from the O-RAN Software Community.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Not assigned)
• Attack Vector: Network (likely)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: Medium (due to DoS potential and lack of patch)

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the buildPrometheusList function of the O-RAN E2T component. The function processes peer information to build Prometheus metrics. If peerInfo is NULL (e.g., due to a malformed request or missing data), the code attempts to dereference it without a null check, causing a segmentation fault and crashing the E2T process. This can be triggered by an attacker sending specially crafted E2AP (E2 Application Protocol) messages to the E2T node.

The O-RAN E2T is responsible for terminating E2 connections from near-real-time RAN Intelligent Controllers (near-RT RICs). A crash in this component can disrupt network management and optimization functions.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void buildPrometheusList(PeerInfo *peerInfo) {
    // No null check
    char *name = peerInfo->name;  // NULL dereference if peerInfo is NULL
    // ... rest of function
}

Patched Code (Conceptual):

void buildPrometheusList(PeerInfo *peerInfo) {
    if (peerInfo == NULL) {
        // Handle error gracefully
        return;
    }
    char *name = peerInfo->name;
    // ... rest of function
}

No official patch has been released by O-RAN. The fix requires adding a null pointer check before dereferencing peerInfo.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy an O-RAN I-Release environment with E2T component exposed on a network.
2. Craft Payload: Send a malformed E2AP message that results in a NULL peerInfo being passed to buildPrometheusList.
3. Trigger: Use a tool like scapy or a custom E2AP fuzzer to send the crafted message.
4. Impact: The E2T process crashes, causing a denial of service.

Example Python snippet (conceptual):

import socket

# Craft a malformed E2AP message (simplified)
payload = b'\x00\x01\x02\x03'  # Placeholder for malformed data
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(('target_ip', 36422))  # Default E2AP port
sock.send(payload)
sock.close()

Blue Team

1. Monitor: Watch for crashes in the E2T process logs (e.g., segmentation faults).
2. Detect: Use network monitoring to identify malformed E2AP messages.
3. Mitigate: Apply network segmentation to limit exposure of E2T nodes. Implement input validation in the E2T code if possible.

Indicators of Compromise (IOCs)

• Network: Malformed E2AP messages on port 36422 (SCTP or TCP).
• Logs: Segmentation fault errors in E2T logs (e.g., SIGSEGV).
• Process: Unexpected termination of the E2T process.
• File: Core dump files generated by the crash.

Detection Engineering

YARA Rule

rule CVE_2024_34044_NULL_PTR_DEREF {
    meta:
        description = "Detects NULL pointer dereference in O-RAN E2T buildPrometheusList"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-34044"
    strings:
        $func = "buildPrometheusList" ascii wide nocase
        $null_check = "peerInfo == NULL" ascii wide nocase
    condition:
        $func and not $null_check
}

Sigma Rule

title: O-RAN E2T NULL Pointer Dereference
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential exploitation of CVE-2024-34044 via malformed E2AP messages
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image: /usr/bin/e2t
        CommandLine: '*segfault*'
    condition: selection
falsepositives:
    - Legitimate crashes due to bugs
level: high

Suricata Rule

alert tcp any any -> any 36422 (msg:"CVE-2024-34044 O-RAN E2T NULL Pointer Dereference"; flow:to_server; content:"|00 01 02 03|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply a null pointer check in buildPrometheusList before dereferencing peerInfo. Monitor O-RAN Software Community for an official fix.
2. Workaround: Restrict network access to E2T nodes using firewalls or ACLs. Only allow trusted near-RT RICs to connect.
3. Monitoring: Enable crash detection and alerting for E2T processes.
4. Update: When a patch is released, update the O-RAN I-Release immediately.

Valters IT
Securing Open RAN Deployments