FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 …

FlexRIC v2.0.0 contains a vulnerability that causes crashes when SCTP associations are closed before E2_SETUP_REQUEST messages are sent. The near-RT RIC incorrectly assumes a mapping between SCTP association and E2 node always exists during cleanup operations and enforces this assumption through assert() calls. Remote unauthenticated attackers can exploit this flaw by establishing an SCTP handshake on port 36421 and immediately disconnecting without sending E2AP messages, resulting in a denial of service condition that crashes the near-RT RIC component.