Enviar #942312: O-RAN-SC SMO L-Release CWE-770 Allocation of Resources Without Limits or Throttling

Summary
An attacker splits one large payload into many smaller, individually-valid events, each below per-event size-based detection. The aggregate payload still exhausts CPU and triggers Kafka broker errors, producing denial of service while no single message raises a size alarm.

Vulnerability
Size-based admission control (Ticket 2's remediation) is evaluated per event. By chunking a large payload into multiple medium events (default ~500 KB each) with minor mutations, the attacker keeps each message under the per-event cap while the summed payload across the burst exhausts resources — the same DoS effect as one oversized message, but invisible to per-event checks.

Discovery
Aggregating a huge total payload across multiple events produced DoS effects (CPU increase, Kafka broker errors) without any individual message crossing the size alarm.

Expected Behavior
The collector should detect cumulative payload volume and similarity patterns (per source and across sources within a time window) and reject the anomalous burst, not just oversize single events.

Actual Behavior
Each smaller message looks normal and is accepted (`202`); the accumulated load eventually drives total DoS.

Impact
- Denial of Service (availability) via aggregate payload volume.
- Hard to detect - per-source/per-event payloads individually look benign.

Issue: https://lf-o-ran-sc.atlassian.net/browse/SMO-203
Exploit: https://gist.github.com/fklement/639eb04a12cc5c015f9b960b0de96d80

Steps to Reproduce
1. Deploy O-RAN-SC SMO/OAM L-Release with a reachable `ves-collector`.
2. From the downloaded gist-scripts:
```bash
cd ../Scripts
# Default: 2 sources, ~500 KB per event, every 2s, with eventId/seq/interval
# mutation so chunks look like distinct normal events.
python3 payload_chunking.py
# Tune aggregate pressure:
THREAD_COUNT=4 INTERVAL=1 python3 payload_chunking.py
```
3. Observe CPU usage, DoS probability, and Kafka errors rising while per-event payload alerts stay inactive.

Remediation
- Track rolling aggregate payload size per source and globally over a time window; reject bursts whose cumulative bytes exceed a threshold.
- Combine size accounting with similarity clustering so chunked sequences are treated as one logical oversized payload.
- Apply backpressure based on total bytes ingested, not just message count.

Detection
- Alert on cumulative bytes/sec per source and across similar-event clusters.
- Correlate medium-size events sharing eventName/fields within short windows.
- Monitor Kafka producer byte throughput and error rate.

• Fuente: ⚠️ https://gist.github.com/fklement/639eb04a12cc5c015f9b960b0de96d80
• Usuario: fklement (UID 100684)
• Sumisión: 2026-08-21 12:32 (hace 28 días)
• Moderación: 2026-09-17 19:06 (27 days later)
• Estado: Aceptado
• Entrada de VulDB: 406595 [O-RAN-SC SMO OAM 2025-06-10 VES Collector denegación de servicio]
• Puntos: 20