| タイトル | O-RAN-SC SMO/OAM L-Release CWE-789 Memory Allocation with Excessive Size Value |
|---|
| 説明 | Summary
The VES Collector does not enforce a strict maximum payload size. Schema-valid events carrying inflated fields consume CPU and memory proportional to their size and trigger Kafka broker errors, leading to denial of service.
Vulnerability
The collector parses and forwards events without validating an upper bound on payload size. An attacker injects a large `additionalFields.padding` string into an otherwise-valid heartbeat. Parsing, buffering, and producing the message to Kafka scales with the payload, exhausting CPU/memory. Payloads exceeding the Kafka broker `message.max.bytes` also cause producer errors and downstream loss.
Discovery
Payloads increased incrementally from 100 KB to 1 MB (PoC ramps 50 KB → 2 MB) caused proportional CPU increases and Kafka broker errors.
Issue: https://lf-o-ran-sc.atlassian.net/browse/SMO-201
Exploit: https://gist.github.com/fklement/1c1ff92588944a021ceb2b5e894973c5
Steps to Reproduce:
1. Deploy O-RAN-SC SMO/OAM L-Release with a reachable `ves-collector`.
2. From the downloaded gist-scripts:
```bash
cd ../Scripts
python3 massive_payload_attack.py
```
The script ramps `BASE_PAYLOAD_SIZE` (50 KB) by `INCREMENT` (100 KB) per message up to `MAX_PAYLOAD_SIZE` (2 MB), one message/second.
3. Monitor collector CPU/memory, Kafka message size and broker errors, and downstream event processing.
Remediation
- Enforce a maximum request body size at the HTTP layer (e.g. `413` above a configured limit such as 1 MB) before JSON parsing.
- Reject events whose serialized size approaches Kafka `message.max.bytes`.
- Stream/parse with bounded buffers; avoid copying full payloads in memory.
- Validate `additionalFields` size and reject unexpected oversized fields.
Detection
- Alert on inbound request body size and serialized event size above a threshold.
- Monitor Kafka producer error rate and broker `message.max.bytes` rejections.
- Track collector memory/CPU correlated with average event size.
|
|---|
| ソース | ⚠️ https://gist.github.com/fklement/1c1ff92588944a021ceb2b5e894973c5 |
|---|
| ユーザー | fklement (UID 100684) |
|---|
| 送信 | 2026年08月21日 12:20 (28 日 ago) |
|---|
| モデレーション | 2026年09月17日 19:06 (27 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 406593 [O-RAN-SC SMO OAM 2025-06-10 VES Collector additionalFields.padding サービス拒否] |
|---|
| ポイント | 20 |
|---|