The vulnerability exists in OpenAirInterface5G 2.4.0 (nr-softmodem) within the E2SM-KPM RAN Function's PRB utilization metric calculation. The functions fill_RRU_PrbTotDl() and fill_RRU_PrbTotUl() divide by the difference between two consecutive total_prb_aggregate samples without verifying that the divisor is non-zero. When a malicious xApp sends a high volume of E42_RIC_SUBSCRIPTION_REQUEST messages via the FlexRIC iApp, the E2 Agent generates frequent KPM Indication reports. If two consecutive samples are identical, the divisor becomes zero, causing a SIGFPE (floating point exception) that crashes the nr-softmodem process. This crash leads to a total 5G cell service interruption for all connected user equipment. The vulnerability requires no authentication and has a CVSS score of 8.6, indicating high severity.

Exploitation causes the nr-softmodem process of the 5G base station to crash due to an unhandled division by zero error, resulting in a complete outage of 5G cell service for all connected devices. The vulnerability does not impact confidentiality or integrity but causes a denial of service (availability impact). No authentication is required to trigger the crash, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting or monitoring incoming E42_RIC_SUBSCRIPTION_REQUEST messages to reduce the risk of triggering the vulnerability. No official fix or temporary workaround has been documented at this time.