Uncovering 'NASty' 5G Baseband Vulnerabilities through Dependency-Aware Fuzzing

Overview: The researchers present an automated, dependency-aware fuzzing framework designed to discover critical vulnerabilities within Non-Access Stratum (NAS) protocol implementations in commercial 5G baseband processors. Serving as the primary signaling protocol governing mobility management and session establishment between user equipment (UE) and the 5G core network, the NAS layer represents a high-risk over-the-air attack surface. The presentation explains why traditional coverage-guided fuzzers fail against stateful cellular protocols and details how a dependency-aware fuzzer uncovered severe memory corruption and denial-of-service flaws across major commercial 5G chipsets.

Key Topics: - Security architecture of the 5G Non-Access Stratum (NAS) protocol layer (5GMM and 5GSM) - Vulnerability of pre-authentication baseband signaling parsers to rogue base station exploitation - Limitations of traditional coverage-guided fuzzers when applied to stateful cellular communication protocols - Dependency-aware fuzzing: modeling protocol state transitions, message sequencing, and Information Element (IE) constraints

Technical Details: In 5G networks, the Non-Access Stratum (NAS) represents the highest control-plane signaling protocol running between the User Equipment (UE) and the 5G Core (5GC). NAS operations are divided into two sub-layers: 5G Mobility Management (5GMM)—which controls device registration, identity verification, authentication, and security mode procedures—and 5G Session Management (5GSM), which manages Packet Data Unit (PDU) sessions. Because mobile baseband processors must parse incoming NAS messages from cellular towers prior to completing cryptographic authentication and integrity verification, parsing vulnerabilities in NAS engines expose smartphones to zero-click over-the-air attacks from rogue base stations.

Traditional mutation-based and coverage-guided fuzzers (such as AFL) perform poorly when auditing baseband firmware. 5G NAS messages have rigid structural formatting requirements, containing complex Information Elements (IEs) and explicit length indicators. Furthermore, the NAS layer is strictly state-dependent: a device will instantly discard advanced signaling messages (such as `Security Mode Command` or `PDU Session Establishment`) unless preceding state machine requirements (such as `Registration Request` and `Authentication Request`) have been successfully negotiated. Blind bit mutations corrupt message structures and violate state prerequisites, causing fuzzing executions to terminate prematurely in shallow error handlers.

To overcome this hurdle, the authors developed a dependency-aware fuzzing engine based on formal 3GPP specifications. The framework maintains an active protocol state machine that guides the target baseband into deep operational states before injecting mutations. It enforces structural constraints on mandatory message headers while applying targeted mutations to optional Information Elements and payload buffers. Auditing commercial 5G modems from top silicon vendors (including Qualcomm, MediaTek, and Samsung Exynos), the framework uncovered multiple high-severity vulnerabilities, including heap buffer overflows and unhandled state machine exceptions that trigger instant baseband crashes and cellular disconnections.

Key Takeaways: Pre-authentication cellular signaling protocols like 5G NAS represent critical over-the-air attack surfaces where parsing flaws can be exploited by rogue base stations to compromise mobile devices. Baseband silicon vendors and telecom carriers must integrate state-aware, dependency-driven fuzzing into their firmware validation pipelines to identify deep logical and memory-safety vulnerabilities. Furthermore, mobile operating systems and standards bodies must enforce strict input sanitization and rate limiting on pre-authentication signaling to minimize exposure to remote baseband attacks.

(AI summary — Gemini Flash)