openairinterface5g 2.4.0 ran_func_kpm_subs.c fill_RRU_PrbTotDl/fill_RRU_PrbTotUl denial of service

Summaryinfo

A vulnerability classified as problematic has been found in openairinterface5g 2.4.0. This issue affects the function fill_RRU_PrbTotDl/fill_RRU_PrbTotUl of the file openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_kpm_subs.c. This manipulation causes denial of service. This vulnerability appears as CVE-2026-37232. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in openairinterface5g 2.4.0. Affected by this vulnerability is the function fill_RRU_PrbTotDl/fill_RRU_PrbTotUl of the file openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_kpm_subs.c. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation. The functions fill_RRU_PrbTotDl() and fill_RRU_PrbTotUl() in openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_kpm_subs.c (lines 182 and 197) compute PRB usage percentages by dividing by the difference of two consecutive total_prb_aggregate samples without checking for zero. When a malicious xApp sends a high volume of E42_RIC_SUBSCRIPTION_REQUESTs via the FlexRIC iApp (port 36422/SCTP), the E2 Agent generates KPM Indication reports at high frequency. If two consecutive sampling intervals yield identical PRB aggregate values, the divisor becomes zero, triggering SIGFPE and crashing the entire 5G base station process (nr-softmodem). This results in complete 5G cell service interruption for all connected UEs. No authentication is required.

It is possible to read the advisory at gitlab.eurecom.fr. This vulnerability is known as CVE-2026-37232 since 04/06/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• openairinterface5g

Version

• 2.4.0

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion