Executive Summary

This vulnerability exists in FlexRIC v2.0.0 where a single SCTP connection can bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs.

When the connection disconnects, only the resources of the first registered xapp_id are cleaned up, while the subsequent xapp_ids and their subscriptions remain as stale entries.

A remote attacker can exploit this behavior to leak subscription state in the iApp, which may lead to resource exhaustion or state corruption over time.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to resource exhaustion or state corruption within the affected application.

Because stale subscription entries remain after disconnects, system resources may be consumed unnecessarily, potentially degrading performance or causing failures.

An attacker exploiting this flaw remotely could cause these issues, impacting the stability and reliability of the system.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring SCTP connections to port 36422 for multiple E42_SETUP_REQUEST messages sent on the same association. Repeated setup requests from a single SCTP connection may indicate exploitation attempts.

Network administrators should look for unusual patterns of multiple E42_SETUP_REQUEST messages within a single SCTP session.

Suggested commands include using packet capture tools like tcpdump or tshark to filter SCTP traffic on port 36422 and analyze the number of E42_SETUP_REQUEST messages per connection.

• tcpdump -i <interface> port 36422 and sctp
• tshark -i <interface> -Y "sctp.port == 36422 && e42_setup_request"

Additionally, monitoring logs or metrics from FlexRIC for multiple setup requests per SCTP association can help detect the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting iApp access to only trusted xApps to prevent unauthorized multiple E42_SETUP_REQUEST messages.

Monitoring SCTP associations for repeated setup requests and disconnecting suspicious connections can reduce exploitation risk.

Ensuring that the setup handler in FlexRIC becomes idempotent per association and that all identities and subscriptions are cleaned up during disconnect is recommended, although no upstream fix was available at the time of disclosure.

Useful 0 Not Useful 0