CVE-2026-37232

{"id": "CVE-2026-37232", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-37232", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T12:54:10.243523Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-06-01T19:16:33.623", "references": [{"url": "https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37232.md", "tags": ["Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gitlab.eurecom.fr/oai/openairinterface5g", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-369"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation. The functions fill_RRU_PrbTotDl() and fill_RRU_PrbTotUl() in openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_kpm_subs.c (lines 182 and 197) compute PRB usage percentages by dividing by the difference of two consecutive total_prb_aggregate samples without checking for zero. When a malicious xApp sends a high volume of E42_RIC_SUBSCRIPTION_REQUESTs via the FlexRIC iApp (port 36422/SCTP), the E2 Agent generates KPM Indication reports at high frequency. If two consecutive sampling intervals yield identical PRB aggregate values, the divisor becomes zero, triggering SIGFPE and crashing the entire 5G base station process (nr-softmodem). This results in complete 5G cell service interruption for all connected UEs. No authentication is required."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en OpenAirInterface5G 2.4.0 (nr-softmodem) en el c\u00e1lculo de la m\u00e9trica de utilizaci\u00f3n de PRB de la funci\u00f3n RAN E2SM-KPM. Las funciones fill_RRU_PrbTotDl() y fill_RRU_PrbTotUl() en openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_kpm_subs.c (l\u00edneas 182 y 197) calculan los porcentajes de uso de PRB dividiendo por la diferencia de dos muestras consecutivas de total_prb_aggregate sin verificar si es cero. Cuando una xApp maliciosa env\u00eda un alto volumen de E42_RIC_SUBSCRIPTION_REQUESTs a trav\u00e9s de la iApp FlexRIC (puerto 36422/SCTP), el Agente E2 genera informes de indicaci\u00f3n KPM a alta frecuencia. Si dos intervalos de muestreo consecutivos producen valores agregados de PRB id\u00e9nticos, el divisor se vuelve cero, lo que activa SIGFPE y provoca la ca\u00edda de todo el proceso de la estaci\u00f3n base 5G (nr-softmodem). Esto resulta en una interrupci\u00f3n completa del servicio de celda 5G para todos los UEs conectados. No se requiere autenticaci\u00f3n."}], "lastModified": "2026-07-22T07:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openairinterface:openairinterface5g:2.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7872191F-FD73-437E-841E-A022AF6306A8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}