Executive brief
EURECOM FlexRIC, a controller used in Open RAN (O-RAN) cellular networks to manage radio access functions, contains a flaw in how it handles incoming network messages. An unauthenticated remote attacker can send a single oversized network packet to crash critical components, including the near-RT RIC, E2 Agent, or xApps. This results in a denial-of-service condition that can disrupt cellular network operations and management.
Technical details
A reachable assertion (CWE-617) exists in the `e2ap_recv_sctp_msg()` function within `src/lib/ep/e2ap_ep.c`. The function allocates a fixed 32KB receive buffer and performs an `assert(rc < len)` on the return value of `sctp_recvmsg()`. A remote, unauthenticated attacker can trigger this assertion by sending an SCTP message with a payload of 32,768 bytes or greater to ports 36421 or 36422. This causes a SIGABRT and process termination before any E2AP PDU validation occurs. In production builds where assertions are disabled (NDEBUG), this flaw may instead lead to a signed-to-unsigned integer overflow and potential out-of-bounds reads.
Affected products
- EURECOM FlexRIC v2.0.0 through commit 6a595d8b (2025-11-12)
Timeline
- 2026-06-01: advisory: NVD and researcher advisory published