-
Bug
-
Resolution: Unresolved
-
Medium
-
None
-
None
-
None
-
Near-RT RIC: H-release
We have found a problem in the H-Release when a deployed xApp continuously sends subscription requests.
After a certain time, the E2 gNB simulator provided by the OSC crashes.
When trying to start the simulator again, the e2mgr pod crashes with the following error:
{"ts":1711619773416,"crit":"INFO","id":"e2mgr","mdc":{"CONTAINER_NAME":"","HOST_NAME":"","PID":"8","POD_NAME":"","SERVICE_NAME":"","SYSTEM_NAME":"","e2mgr":"0.2.2","time":"2024-03-28T09:56:13Z"},"msg":"#RanConnectStatusChangeManager.ChangeStatus - RAN name: gnb_734_373_16b8cef1, setting alarm at RanAlarmService... event: gnb_734_373_16b8cef1_UNDER_RESET"}
{"ts":1711619773416,"crit":"INFO","id":"e2mgr","mdc":{"CONTAINER_NAME":"","HOST_NAME":"","PID":"8","POD_NAME":"","SERVICE_NAME":"","SYSTEM_NAME":"","e2mgr":"0.2.2","time":"2024-03-28T09:56:13Z"},"msg":"#ranAlarmServiceInstance.SetConnectivityChangeAlarm - RAN name: gnb_734_373_16b8cef1 - Connectivity state was changed to UNDER_RESET"}
{"ts":1711619773416,"crit":"INFO","id":"e2mgr","mdc":{"CONTAINER_NAME":"","HOST_NAME":"","PID":"8","POD_NAME":"","SERVICE_NAME":"","SYSTEM_NAME":"","e2mgr":"0.2.2","time":"2024-03-28T09:56:13Z"},"msg":"#RnibDataService.GetNodeb - RAN name: gnb_734_373_16b8cef1, connection status: UNDER_RESET, associated E2T: , setup from network: true"}
{"ts":1711619773416,"crit":"INFO","id":"e2mgr","mdc":{"CONTAINER_NAME":"","HOST_NAME":"","PID":"8","POD_NAME":"","SERVICE_NAME":"","SYSTEM_NAME":"","e2mgr":"0.2.2","time":"2024-03-28T09:56:13Z"},"msg":"#E2ResetRequestNotificationHandler.Handle - Summary: elapsed time for receiving and handling reset request message from E2 terminator: 2.835360 ms"}
{"ts":1711619773416,"crit":"INFO","id":"e2mgr","mdc":{"CONTAINER_NAME":"","HOST_NAME":"","PID":"8","POD_NAME":"","SERVICE_NAME":"","SYSTEM_NAME":"","e2mgr":"0.2.2","time":"2024-03-28T09:56:13Z"},"msg":"#E2ResetRequestNotificationHandler.Handle - Summary: elapsed time for receiving and handling reset request message from E2 terminator: 2.938046 ms"}
{"ts":1711619773416,"crit":"INFO","id":"e2mgr","mdc":{"CONTAINER_NAME":"","HOST_NAME":"","PID":"8","POD_NAME":"","SERVICE_NAME":"","SYSTEM_NAME":"","e2mgr":"0.2.2","time":"2024-03-28T09:56:13Z"},"msg":"#E2ResetRequestNotificationHandler.Handle - RIC_RESET_REQUEST has been parsed successfully &{E2ApPDU:{InitiatingMessage:{ProcedureCode:3 Criticality:{Reject:} Value:{E2ResetRequest:{ProtocolIes:{ResetRequestIEs:[{ID:49 Criticality:{Ignore:} Value:{TransactionID:0xc00032e488 Cause:<nil>}} {ID:1 Criticality:{Ignore:} Value:{TransactionID:<nil> Cause:0xc00008a780}}]}}}}}}"}
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x91d016]
goroutine 228 [running]:
e2mgr/models.NewE2ResetResponseMessage(0xc00009b7d0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
/opt/E2Manager/models/e2_reset_response.go:88 +0x236
e2mgr/handlers/rmrmsghandlers.(*E2ResetRequestNotificationHandler).handleSuccessfulResponse(0xc000382280, 0xc0004be180, 0x14, 0xc0003601c0, 0xc00009b7d0)
/opt/E2Manager/handlers/rmrmsghandlers/e2_reset_request_handler.go:168 +0x65
e2mgr/handlers/rmrmsghandlers.(*E2ResetRequestNotificationHandler).Handle(0xc000382280, 0xc0003601c0)
/opt/E2Manager/handlers/rmrmsghandlers/e2_reset_request_handler.go:111 +0x668
created by e2mgr/managers/notificationmanager.NotificationManager.HandleMessage
/opt/E2Manager/managers/notificationmanager/notification_manager.go:53 +0x2db
deployment-ricplt-e2mgr-577c8958d9-zrq2w
We also include a short graph with the measured pod states as well as the gNB connection status, which illustrates the described behavior during such an attack.
This behavior can then be executed for any length of time, which leads to a kind of DoS for the e2mgr.
