Executive brief
FlexRIC, a software controller used in 5G Radio Access Networks (RAN), is vulnerable to a remote crash. An attacker can send a specially crafted message to the controller that causes the system to shut down unexpectedly. This results in a denial of service, potentially disrupting cellular network management and operations.
Technical details
A NULL pointer dereference exists in FlexRIC v2.0.0 (specifically in src/ric/plugin_ric.c) within the sm_plugin_ric() function. When the near-RT RIC receives a RIC_INDICATION message containing a ran_func_id that is not present in its registry, the lookup function returns NULL. In debug builds, this triggers an assertion failure (SIGABRT); in release builds where assertions are disabled, the subsequent dereference of the NULL pointer leads to a segmentation fault (SIGSEGV). A remote, unauthenticated attacker can exploit this by sending a crafted SCTP packet to port 36421, causing the RIC to crash.
Affected products
- EURECOM FlexRIC v2.0.0 through commit 6a595d8b
Timeline
- 2026-06-01: advisory: NVD and researcher advisory published