Uncovering NASty 5G Baseband Vulnerabilities through Dependency-Aware Fuzzing

Uncovering NASty 5G Baseband Vulnerabilities through Dependency-Aware Fuzzing

Speakers: Ali Ranjbar, Research Assistant, Pennsylvania State University; Tianchang Yang, PhD Student, Pennsylvania State University

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=gXGIo5fy800

Reading time: ~8 minutes

Type: Briefing

TL;DR

Researchers from Penn State built LOTUS, a dependency-aware fuzzing framework for 5G baseband processors, and used it to discover seven unique exploitable vulnerabilities — including one critical and two high-severity — in Samsung's Exynos baseband as deployed in Galaxy S21 and Google Pixel 6 devices. All bugs were triggered over-the-air using a software-defined radio testbed, and five received CVEs. The core innovation is iterative symbolic analysis, which automatically identifies and initializes the state variables that 5G NAS protocol handlers require before they will process any input, a problem that stymied prior fuzzing approaches.

Introduction

Every modern smartphone carries two processors: the application processor running Android or iOS, and a separate baseband processor that handles all cellular communication. The baseband runs a real-time operating system, is written largely in C and C++, lacks standard exploit mitigations like ASLR, and communicates over the air with any nearby cell tower — including attacker-controlled fake ones. A vulnerability in baseband firmware can therefore be exploited by an adversary without any user interaction, no app installation, no social engineering.

Prior work showed that 4G basebands were fuzzable, but 5G basebands — which Samsung rewrote in heavily object-oriented C++ — defeated existing tools. The NAS (Non-Access Stratum) layer, responsible for session management and mobility between the device and the core network, is particularly valuable to attackers because it persists connectivity and handles re-registration. The "NASty" in the talk title is a direct acknowledgment that this is exactly what the team targeted.

What Makes 5G Basebands Hard to Fuzz

Prior fuzzing tools like Basive and FirmWire each addressed part of the problem but left critical gaps for 5G.

Basive pioneered emulation-based baseband fuzzing but required massive manual hook setup that does not scale to new firmware versions.

FirmWire automated hook discovery via pattern matching and added full-system emulation using PANDA/Avatar2, but only supported 4G basebands written in plain C and could not handle protocol statefulness.

▶ Watch: Prior Work and Limitations (06:01)

The 5G NAS task in Samsung's Exynos baseband introduces two compounding difficulties:

1. Object-oriented C++ with virtual dispatch. Function calls go through vtables, making static analysis and emulation substantially harder. The team wrote Ghidra scripts to recover class structures and resolve vtable entries into readable function calls.
2. State-dependent message processing. The NAS task maintains a complex internal state machine. Before it will process any incoming NAS message, it checks more than ten state variables — things like Mobility Management (MM) state and Access Stratum (AS) connection state. If these are not initialized correctly, every fuzzed input is silently discarded before reaching any interesting code.

LOTUS: The Tool

LOTUS extends FirmWire to support 5G Shannon basebands and adds two key new capabilities.

Full system emulation for Cortex-A. Samsung's 5G basebands switched from Cortex-R to Cortex-A CPUs, introducing a full Memory Management Unit and virtual address translation. The team reverse-engineered the baseband's page table setup, identified two phases of address translation (boot-stage and runtime), emulated the Shannon timer and Exynos multi-core timer, and achieved stable task spinup.

▶ Watch: Emulator Architecture (08:01)

Iterative symbolic analysis for state initialization. This is the core research contribution. Fully symbolic execution of the NAS task — making all ~100 state variables symbolic simultaneously — caused the symbolic execution engine to explode: after four hours it was exploring over 9,000 concurrent paths and consumed more than 1 TB of RAM (to the consternation of a labmate who noticed the server's memory filling up).

Instead, the team developed an iterative approach: start with zero symbolic variables and only make the fuzz input symbolic. When symbolic execution encounters a branch gated on a state variable and cannot proceed, record that variable, terminate, then rerun with that variable added to the symbolic set. Each iteration extends reachability a little further, and earlier results are cached to fast-track subsequent runs. The final output is a concrete set of state variable values that, when loaded into the emulated NAS task, allow fuzz inputs to reach deep message-processing code.

▶ Watch: Iterative Symbolic Analysis (28:02)

Grammar-aware fuzzing. LOTUS integrates a libAFL-based fuzzer that understands NAS message structure, generating well-formed but value-mutated messages rather than random byte sequences.

Bypassing Authentication and the Test Harness Trick

NAS messages are normally encrypted and integrity-protected. Early in the project, the team leveraged a prior Black Hat research authentication bypass — setting an invalid security header type to pass all security checks — but that was patched. The final solution was a fake test harness built into the baseband itself: Samsung's firmware includes a test-mode path that can be activated by setting a flag in NVRAM, causing the NAS task to accept plaintext messages. This discovery eliminated the need for any external bypass.

Vulnerabilities Discovered

Running the fuzzer against the Samsung Exynos baseband (as found in Galaxy S21 and Google Pixel 6) produced seven unique exploitable crashes, all triggerable via over-the-air messages:

| Severity | Count |

|----------|-------|

| Critical | 1 |

| High | 2 |

| Moderate | 3 |

| Low | 1 |

Five of the moderate-and-above vulnerabilities received CVE assignments. The team also found an additional heap overflow that sits outside the directly tested code region.

▶ Watch: Vulnerability Discovery and Demo (30:03)

Bugs include both stack overflows and heap overflows. To validate exploitability, the team replayed crashing inputs over the air using a USRP B210 as a base station and Open5GS as the core network. On camera at Black Hat, a Samsung Galaxy S21 received a malicious "Registration Accept" message, the baseband crashed, and the phone rebooted directly into Samsung's upload debug mode — producing audible applause from the audience.

Exploitation Primitives and Protections

The 5G baseband removes RWX memory regions (present in 4G), so classic shellcode injection is gone. However:

• Stack canaries exist but are stored in a global memory region (not randomized per-stack-frame). A heap overflow achieving write-what-where can overwrite the global canary value, neutering the protection, and then chain a stack overflow with ROP gadgets.
• Heap overflows provide write-what-where primitives. One demonstrated attack path would flip the NRMM fake-test-enable flag in NVRAM, causing the baseband to accept all messages in plaintext.

The researchers also showed LOTUS achieving more than double the code coverage of prior tools across both 4G and 5G NAS tasks — without requiring the hours of manual state setup that FirmWire demanded.

Notable Quotes

"Complexity doesn't mean better security. In fact, it often hides vulnerabilities even deeper." — Ali Ranjbar 38:04

"In the worst case, they can escalate attacks into your main operating system." — Ali Ranjbar 04:00

"There is still a lot of work ahead. We need more research, more tooling, and definitely more focus on the protocols that we haven't been able to look at yet." — Ali Ranjbar 38:04

Key Takeaways

• 5G baseband NAS code is a high-value, largely unexplored attack surface reachable over the air from a fake base station with no user interaction required.
• State-dependent protocol handlers block naive fuzzers. Iterative symbolic analysis is an effective, scalable approach to automatically discovering the state initialization needed to expose deep processing paths.
• Samsung's Exynos baseband in Galaxy S21 / Pixel 6 had at least seven exploitable vulnerabilities in NAS message handling, all verified on real hardware over the air.
• Stack canary protection is weaker than expected in these basebands: the canary value lives in a globally addressable location that a heap write-what-where can overwrite.
• LOTUS's methodology is portable to other baseband vendors; the team tested MediaTek firmware using the same approach and is encouraging the research community to extend coverage to additional chipsets.

Slides: No slides PDF was available for this talk. Paper and code are available via QR codes shown at the end of the talk; contact the authors at Pennsylvania State University for access.