CVE-2024-34049

Executive Summary

CVE-2024-34049 is a denial-of-service vulnerability in the Open Networking Foundation (ONF) SD-RAN Rimedo rimedo-ts project, version 0.1.1. The flaw resides in the reader.go file, specifically within a function that parses PLMN (Public Land Mobile Network) ID strings. When the function receives a PLMN ID string shorter than 3 characters, it triggers a slice bounds out-of-range panic, causing the application to crash. This is a classic out-of-bounds read/write vulnerability (CWE-823) that can be exploited remotely without authentication, leading to a denial of service. The vulnerability is unpatched, and no public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

This vulnerability affects the Go-based SD-RAN Rimedo project, which is part of the ONF’s open-source RAN intelligent controller (RIC) ecosystem. The vulnerable component is rimedo-ts, a Go module. Organizations using this software in their 5G or Open RAN deployments should treat this as a critical supply chain risk, as a crash in the PLMN parsing logic could disrupt network slicing or RAN control functions.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned. Based on the vulnerability characteristics, a reasonable assessment would be:

• Attack Vector (AV): Network (N) – the PLMN ID is typically received over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the crash is confined to the vulnerable component.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – the crash causes a denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Deep Dive & Mechanics

The vulnerability is in the reader.go file of the rimedo-ts package. The function responsible for parsing PLMN IDs uses a slice operation without checking the length of the input string. The problematic code is:

return plmnIdString[0:3], plmnIdString[3:]

This code assumes that plmnIdString is at least 3 characters long. If a malicious actor sends a PLMN ID string with fewer than 3 characters (e.g., an empty string or "12"), the slice operation plmnIdString[0:3] will attempt to access indices beyond the string's length, causing a runtime panic. In Go, this panic is unrecoverable and crashes the entire process.

The vulnerability is triggered during the parsing of incoming messages that contain PLMN IDs. In an SD-RAN environment, these messages could be part of standard RAN control procedures, making the attack surface broad.

Vulnerable vs. Patched Code

Vulnerable Code (rimedo-ts 0.1.1):

func parsePLMN(plmnIdString string) (string, string) {
    return plmnIdString[0:3], plmnIdString[3:]
}

Patched Code (hypothetical fix):

func parsePLMN(plmnIdString string) (string, string, error) {
    if len(plmnIdString) < 3 {
        return "", "", fmt.Errorf("invalid PLMN ID: too short")
    }
    return plmnIdString[0:3], plmnIdString[3:], nil
}

The fix adds a length check before performing the slice operation, returning an error instead of panicking. The caller must then handle the error gracefully.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of SD-RAN Rimedo rimedo-ts 0.1.1.
• Network access to the service that accepts PLMN IDs.

Exploitation Steps:

1. Identify the endpoint or message type that accepts a PLMN ID string. This is typically part of the E2AP (E2 Application Protocol) messages in the RIC.
2. Craft a malicious message with a PLMN ID string of length 0, 1, or 2 (e.g., an empty string or "12").
3. Send the message to the target service.
4. Observe the service crash due to the slice bounds panic.

Example Payload (using netcat or a custom script):

echo -n "12" | nc target_ip target_port

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for application crashes or panics in logs.
• Look for unusual PLMN ID values (length < 3) in network traffic.
• Use the detection rules provided below.

Mitigation:

• Apply input validation at the network edge (e.g., WAF or API gateway) to reject PLMN IDs shorter than 3 characters.
• If possible, upgrade to a patched version once available.
• Implement a crash recovery mechanism (e.g., process supervisor) to restart the service automatically.

Indicators of Compromise (IOCs)

• Log Entry: A Go panic log containing the string slice bounds out of range and reader.go.
• Network Traffic: E2AP messages containing PLMN ID fields with length < 3.
• Process Behavior: Unexpected termination of the rimedo-ts process.

Detection Engineering

YARA Rule

rule CVE_2024_34049_Panic_Detection {
    meta:
        description = "Detects Go panic logs related to CVE-2024-34049"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-34049"
    strings:
        $panic = "panic: runtime error: slice bounds out of range"
        $file = "reader.go"
    condition:
        $panic and $file
}

Sigma Rule

title: CVE-2024-34049 SD-RAN Rimedo Panic Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Go panic logs indicating exploitation of CVE-2024-34049
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: rimedo-ts
detection:
    selection:
        EventID: 1000  # Example Windows event ID for application crashes
        Message|contains: 
            - "slice bounds out of range"
            - "reader.go"
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-34049 SD-RAN Rimedo PLMN ID Out-of-Bounds"; content:"|00 03|"; depth:2; offset:0; content:"|12|"; within:2; sid:1000001; rev:1;)

Note: The Suricata rule above is a placeholder. A real rule would need to match the specific protocol framing of E2AP messages, which is beyond the scope of this report.

Remediation & Mitigation

1. Immediate: Implement input validation to reject PLMN ID strings shorter than 3 characters before they reach the vulnerable function.
2. Short-term: Apply the patch shown in the "Vulnerable vs. Patched Code" section to the reader.go file and rebuild the binary.
3. Long-term: Monitor the ONF SD-RAN repository for an official patch. Consider contributing a fix upstream.
4. Compensating Controls: Use a Web Application Firewall (WAF) or API gateway to filter malformed PLMN IDs. Implement process monitoring and auto-restart for the rimedo-ts service.

Valters IT
DevSecOps & Cyber Threat Intelligence