CVE-2024-34045

Executive Summary

CVE-2024-34045 is a denial-of-service vulnerability in the O-RAN E2T I-Release component. The flaw resides in the sctpThread.cpp file, where the Increment() function is called on a counter within message.peerInfo->counters[IN_INITI][MSG_COUNTER][ProcedureCode_id_E2setup]. Under specific conditions, this operation can cause a crash, leading to service disruption. The vulnerability affects the O-RAN E2T interface, which is critical for communication between the RAN Intelligent Controller (RIC) and E2 nodes. No public exploit or patch details are currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native C++ component within the O-RAN software stack, typically deployed in telecommunications infrastructure.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for scoring. However, based on the nature of the vulnerability (crash in a network-facing thread), a reasonable assessment would be:

• Attack Vector: Network (AV:N) – The E2T interface is network-accessible.
• Attack Complexity: Low (AC:L) – Likely triggered by malformed or specific SCTP messages.
• Privileges Required: None (PR:N) – No authentication needed to send messages.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The crash affects the E2T process only.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Service crash leads to denial of service.

Threat Level: High (potential for remote denial of service in critical telecom infrastructure).

Deep Dive & Mechanics

The vulnerability is in the sctpThread.cpp file of the O-RAN E2T I-Release. The function Increment() is called on a counter array element:

message.peerInfo->counters[IN_INITI][MSG_COUNTER][ProcedureCode_id_E2setup]->Increment();

The crash likely occurs due to one of the following:

• Null pointer dereference: message.peerInfo or the counter pointer is null.
• Out-of-bounds access: The indices IN_INITI, MSG_COUNTER, or ProcedureCode_id_E2setup exceed array bounds.
• Race condition: Concurrent access to the counter without proper synchronization.

The sctpThread handles SCTP (Stream Control Transmission Protocol) messages. An attacker can send a crafted SCTP packet that triggers the vulnerable code path, causing the E2T process to crash and disrupting RIC-to-E2 node communication.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code snippet is:

// Vulnerable: No null check or bounds validation
message.peerInfo->counters[IN_INITI][MSG_COUNTER][ProcedureCode_id_E2setup]->Increment();

A patched version would include:

// Patched: Added null and bounds checks
if (message.peerInfo != nullptr &&
    IN_INITI < MAX_COUNTER_TYPE &&
    MSG_COUNTER < MAX_COUNTER_SUB &&
    ProcedureCode_id_E2setup < MAX_PROCEDURE_CODE &&
    message.peerInfo->counters[IN_INITI][MSG_COUNTER][ProcedureCode_id_E2setup] != nullptr) {
    message.peerInfo->counters[IN_INITI][MSG_COUNTER][ProcedureCode_id_E2setup]->Increment();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the O-RAN E2T network interface (port 36422/SCTP by default).
• Ability to send raw SCTP packets.

Exploitation Steps:

1. Identify the target E2T instance (e.g., via Shodan dork o-ran e2t).
2. Craft an SCTP packet with a malformed E2 Setup Request message that triggers the vulnerable code path.
3. Send the packet to the target's SCTP port.
4. Monitor for service crash (E2T process termination).

Example Python script using Scapy:

from scapy.all import *
import socket

# Craft SCTP packet with malformed E2 Setup Request
# This is a conceptual example; actual payload requires protocol knowledge
payload = b"\x00" * 100  # Malformed data
pkt = IP(dst="target_ip")/SCTP(sport=12345, dport=36422)/Raw(load=payload)
send(pkt, verbose=False)

Blue Team

Detection:

• Monitor SCTP traffic for unusual patterns or malformed packets.
• Set up alerts for E2T process crashes or restarts.
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Apply network segmentation to limit access to E2T interfaces.
• Implement rate limiting on SCTP connections.
• Deploy a WAF/IPS that can inspect SCTP payloads for anomalies.

Indicators of Compromise (IOCs)

• Network:
  • SCTP packets with malformed E2 Setup Request messages.
  • Repeated connection attempts to port 36422/SCTP from unknown sources.
• Host:
  • E2T process crash logs (e.g., segmentation fault in sctpThread.cpp).
  • Core dumps from the E2T process.
• File:
  • /var/log/e2t/crash.log containing stack traces referencing sctpThread.cpp.

Detection Engineering

YARA Rule

rule CVE_2024_34045_E2T_Crash {
    meta:
        description = "Detects crash patterns in O-RAN E2T sctpThread"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-34045"
    strings:
        $crash1 = "sctpThread.cpp" nocase
        $crash2 = "Increment()" nocase
        $crash3 = "ProcedureCode_id_E2setup" nocase
    condition:
        all of them
}

Sigma Rule

title: O-RAN E2T Crash via SCTP Thread
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-34045 causing E2T crash
author: Valters IT
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "sctpThread.cpp" and "Increment()" and "ProcedureCode_id_E2setup"
    condition: selection
falsepositives:
    - Legitimate crashes due to memory corruption
level: high

Suricata Rule

alert sctp any any -> any 36422 (msg:"CVE-2024-34045 O-RAN E2T SCTP Crash Attempt"; content:"|00 00 00 00|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Restrict network access to the E2T interface (port 36422/SCTP) to trusted IPs only.
• Monitor for abnormal SCTP traffic and process crashes.

Long-term:

• Apply vendor patch when available (monitor O-RAN Software Community releases).
• Implement input validation and bounds checking in the sctpThread.cpp code.
• Conduct a code review of all counter increment operations in the E2T component.

Workaround:

• If patching is not possible, disable the E2T service temporarily or use a reverse proxy to filter malformed messages.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert