Relocate-Vote: Using Sparsity Information to Exploit Ciphertext Side-Channels

CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks

Speakers: Yilu Dong, Tianchang Yang, Abdullah Al Ishtiaq, Syed Md Mukit Rashid, Ali Ranjbar, Kai Tu, Tianwei Wu, Md Sultan Mahmud, Syed Rafiul Hussain (The Pennsylvania State University)

Conference: USENIX Security

YouTube: N/A - Peer-Reviewed Paper

Overview

The rapid evolution of 5G cellular networks, driven by a new service-based architecture (SBA), introduces unprecedented flexibility and scalability but also presents complex security challenges. The paper "CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks" addresses these challenges by presenting CoreCrisis, a novel stateful black-box fuzz-testing framework designed to uncover implementation flaws in 5G Core (5GC) networks. Developed by researchers at The Pennsylvania State University, CoreCrisis moves beyond the limitations of previous static and manually-driven security analysis methods by employing a dynamic, two-step iterative learning and fuzzing approach.

CoreCrisis distinguishes itself by first constructing an initial Finite State Machine (FSM) representation of the 5GC using only benign inputs, leveraging efficient divide-and-conquer and property-driven equivalence checking techniques. Subsequently, it utilizes this learned FSM to guide state-aware mutations, generating malicious inputs to target underexplored states and discover vulnerabilities. Critically, CoreCrisis continuously refines its FSM based on observed responses, enabling a deeper and more effective exploration of the 5GC's complex state space. This systematic approach is vital for identifying elusive bugs that can lead to severe consequences, such as denial-of-service, authentication bypass, and billing fraud.

The significance of CoreCrisis lies in its ability to systematically analyze black-box 5GC implementations, where internal details are often inaccessible. By focusing on the 5G Non-Access Stratum (NAS) protocol, which is crucial for user authentication and session management, CoreCrisis provides a powerful tool for network operators and developers to proactively identify and mitigate critical security vulnerabilities. Its evaluation on three open-source and one commercial 5GC implementation yielded significant findings, including 7 categories of specification deviations and 13 crashing vulnerabilities, demonstrating its superior effectiveness compared to existing state-of-the-art fuzzers.

Background

The shift from monolithic architectures in previous cellular generations to the Service-Based Architecture (SBA) in 5G has revolutionized core network design. 5GC functionalities are divided into various Network Functions (NFs), each providing API access to others. While this modularity offers flexibility and scalability, it also introduces increased complexity due to the sheer number of components and their intricate interactions. The 3rd Generation Partnership Project (3GPP) technical specifications (e.g., [13–16]) aim to guide 5GC implementations, but prior research [18,23–25,37,39,45,56,60] has highlighted ambiguities and underspecifications within these standards. The absence of a definitive reference implementation further exacerbates misinterpretations, leading to exploitable logical bugs like authentication bypass and billing fraud, as well as system crashes that cause Denial-of-Service (DoS).

Existing security analysis methods for cellular networks broadly fall into two categories: stateless and stateful testing. Stateless analyses often struggle with the highly stateful nature of cellular protocols, requiring extensive manual examination [45] or relying on predefined test cases [63], which limits their efficiency and exploration depth. Stateful testing approaches, such as those leveraging automata learning algorithms [24,39,42,60], construct an FSM representation of the implementation. However, these methods typically depend on a static, predefined set of input symbols, limiting them to vulnerabilities detectable within that set and requiring significant manual effort from human experts to assemble. They are also often restricted to finding logical errors, unable to detect memory safety violations or crashes that demand a wider range of inputs. More recent approaches [12] allow for testing beyond the initial symbol set but lack dynamic FSM updates for deeper state exploration. Conversely, methods that generate diverse inputs and learn states simultaneously [52] often use ad-hoc learning, leading to poor state coverage and a focus primarily on memory bugs rather than protocol violations.

A significant challenge in 5GC security testing, especially in commercial deployments, is the black-box nature of implementations. Access to source code, binaries, or runtime environments is typically restricted, forcing analyses to rely solely on observable feedback from the User Equipment (UE). Attackers can leverage a compromised UE with a valid SIM card to send arbitrary malicious messages over the 5G Non-Access Stratum (NAS) protocol—a critical interface for user authentication, security context setup, and session management—thereby triggering internal API interactions between NFs. The inherent statefulness of the NAS protocol further complicates black-box analysis, as effective testing requires understanding the implementation's state machine. Relying on a manually constructed reference FSM from specifications [37,38] is often insufficient due to varying implementation granularity and potential deviations from standards. This necessitates accurate, implementation-specific state inference, which traditional automata learning struggles with due to scalability issues, static symbol sets, and the inability to dynamically refine the FSM. CoreCrisis was specifically designed to overcome these fundamental limitations.

Key Findings

CoreCrisis's comprehensive evaluation on four diverse 5GC implementations—three open-source (Open5GS, free5GC, and OpenAirInterface 5G core network (OAI-CN-5G)) and one commercial (Amarisoft 5GC)—revealed a significant array of previously unknown security flaws and protocol deviations. The framework successfully identified 7 categories of deviations from technical specifications and 13 distinct crashing vulnerabilities, leading to severe impacts such as Denial-of-Service (DoS), authentication bypass, and billing fraud. Out of these findings, 8 CVEs have been assigned to 14 of the identified vulnerabilities, underscoring their severity and novelty.

Specifically, CoreCrisis uncovered:

• 3 exploitable protocol violations (P1-P3):
• P1 (Open5GS): A sink state in AMF leading to DoS.
• P2 (OAI-CN-5G): An authentication bypass vulnerability due to incorrect message handling, where a plaintext SecurityModeComplete message is accepted before authentication, allowing an attacker to register illegitimate UEs. This was detected via a dynamically learned transition.
• P3 (free5GC): An identity spoofing vulnerability caused by missing validation checks for IMEI/IMEISV values, potentially enabling attackers to bypass device blacklists or gain unauthorized access. This was found in a dynamically learned state after FSM refinement.
• 7 additional categories of logical deviations (D1-D7): These behaviors, while not always directly exploitable, represent non-compliance with 3GPP specifications. Examples include:
• D1 (Open5GS, OAI-CN-5G): Incorrect state transitions, such as accepting IdentityResponse without a preceding RegistrationRequest.
• D3 (Open5GS, OAI-CN-5G, Amarisoft): Early acceptance of protected messages before SecurityModeComplete, attributed to ambiguities in TS 24.501.
• Other deviations related to handling of Security Header Type (SHT) in various states and message types. These deviations can be used for fingerprinting implementations or evading intrusion detection systems.
• 13 crashing vulnerabilities (C1-C13): These issues, identified across Open5GS, free5GC, OAI-CN-5G, and Amarisoft, result in NF crashes and subsequent DoS.
• C1, C6, C8, C9, C10: Five crashes related to improper handling of Security Header Type (SHT), where implementations assume a MAC is present and perform byte operations without validating message length, leading to out-of-bounds access or assertion failures. For instance, C6 in free5GC is an array index out of bound error.
• C2, C3, C4, C5, C7, C11, C12, C13: Eight crashes triggered by malformed message fields. For example, C13 in Amarisoft 5GC is a segmentation fault caused by an oversized SUCI in a RegistrationRequest.

In comparative analyses, CoreCrisis demonstrated superior performance against state-of-the-art fuzzers like AFLNet, Boofuzz, and Fuzzowski. Despite having a slower testing speed (due to intricate feedback processing and FSM refinement), CoreCrisis consistently achieved the highest code coverage across all tested open-source implementations. Crucially, CoreCrisis was the only tool capable of detecting logical vulnerabilities (P1-P3 and D1-D7), while other fuzzers only found crashes. Ablation studies further confirmed that CoreCrisis's novel components—particularly stateful testing, FSM guidance, and dynamic refinement—are critical to its effectiveness, with 18 of the 23 identified issues (78.3%) being stateful and 4 only discoverable through FSM refinement. The property-driven equivalence checking technique significantly reduced the total number of queries required for FSM learning by 87.98% in free5GC and 84.92% in Open5GS, demonstrating a substantial improvement in efficiency.

Technical Deep Dive

CoreCrisis is a context-aware, threat-driven, learn-and-fuzz-based black-box testing framework designed to navigate the complex and stateful nature of 5GC implementations. Its workflow is divided into two iterative stages: an initial FSM learning stage and a subsequent dynamic testing stage, which continuously refines the FSM.

The framework comprises three main components: the Message Adapter, the State Inference Module, and the Guided Testing Module. The Message Adapter, built upon a modified UERANSIM (an open-source UE and gNB simulator), handles abstract symbol interpretation, input mutation, and concrete message construction and forwarding. The State Inference Module, implemented with LearnLib and using the TTT algorithm [40], performs initial FSM learning. The Guided Testing Module, written in Python3, orchestrates the fuzzing loop, power scheduling, feedback processing, and protocol violation oracles.

Initial FSM Learning

To address the scalability and efficiency challenges (C1) of learning a monolithic FSM for complex 5GC implementations, CoreCrisis introduces two novel techniques:

1. Divide-and-Conquer FSM Learning: CoreCrisis leverages domain-specific knowledge of NF dependencies from 3GPP specifications to partition the monolithic FSM into smaller, more manageable FSMs, each representing a single NF. For instance, the NAS procedure is divided into two stages: learning the UE registration procedures handled by the Access and Mobility Management Function (AMF), and then learning session management procedures handled by the Session Management Function (SMF), which only occur after successful registration. This functional split significantly reduces the complexity of FSM construction, allowing CoreCrisis to linearly combine these smaller FSMs after independent learning.

1. Property-Driven Equivalence Checking (EC): This technique incorporates domain knowledge of 5GC procedures to generate more targeted EC queries, accelerating the discovery of meaningful counterexamples. CoreCrisis extracts key protocol states and transitions from technical specifications (e.g., Table 1 for AMF, Figure 4 for AMF's protocol FSM) and formulates these expected behaviors as compliance properties. These properties are expressed in regular expressions, such as ⟨regReq/authReq⟩·(¬⟨deregReq/deregAcpt⟩)∗·⟨authResp/SMCmd⟩, which guide the generation of EC queries. These queries are more likely to uncover discrepancies between the hypothesized FSM and the actual implementation because they target critical transitions that all 5GC implementations are expected to follow. By capping the number of generated EC queries per iteration, CoreCrisis ensures efficiency, even if it results in an initially observationally correct but incomplete FSM, which is later refined dynamically.

Dynamic Testing and FSM Refinement

The second stage utilizes the learned skeleton FSM to guide threat-driven fuzzing and explore the core network's internal state space. This phase addresses sequence-level mutations (C2) and the challenge of acquiring fuzzing feedback in black-box settings (C3).

1. State-Aware Mutation Strategy: CoreCrisis employs a two-phased mutation strategy that prioritizes less-explored or potentially vulnerable states. It maintains a two-level corpus: one for unique accessing sequences to each state and another for messages leading to unique transitions from the current state. To test a specific target state, CoreCrisis selects an under-explored sequence from the corpus, executes it to set the system to the desired state, and then introduces a mutated symbol to probe for new states or transitions. For separated FSMs learned via divide-and-conquer, CoreCrisis sequentially combines them by identifying connecting states between NFs (e.g., state a6 of AMF corresponds to state s0 of SMF) and concatenating their accessing sequences.

1. Grammar-Aware Message Construction: To overcome the limitations of byte-level mutations, which often generate invalid NAS messages, CoreCrisis leverages existing open-source UE implementations (specifically UERANSIM [34]). It transforms predefined structure definitions and computation functions (for MAC calculation, encryption, encoding) into message mutation functions. This grammar-aware capability allows CoreCrisis to generate messages that are either syntactically (e.g., incorrect field types or unexpected enum values), semantically (e.g., omitting encryption or using incorrect security keys), or structurally (e.g., mutated encoded bytes) malformed. This enables both positive (valid message acceptance) and negative (invalid message rejection) testing.

1. Dynamic FSM Refinement: CoreCrisis addresses the black-box feedback challenge by adopting an enhanced approach to analyzing response messages. Any response differing from previously observed responses (different type, unique response code, or distinct message body content) at the current testing state indicates a new state or transition. When a test input at state si produces an unseen response, CoreCrisis dynamically refines the FSM without re-learning the entire automaton. It creates a hypothetical state sh and a transition from si to sh. To verify sh, it tests all benign input symbols on sh. If the input/output pairs align with an existing state sj, sh is merged with sj, and the FSM is updated with a new transition si → sj. If no match, sh is formally introduced as a new state. This iterative refinement allows CoreCrisis to explore refined states and discover vulnerabilities triggered by multiple mutations.

1. Resetting Core Network: To ensure each testing run starts from a fresh initial state without time-consuming restarts of the entire 5GC, CoreCrisis assigns a new UE identity (SUPI) for each new testing sequence. This simulates a fresh user context, minimizing residual context interference and allowing for rapid, independent test executions.

Vulnerability Detection Oracles

CoreCrisis employs effective test oracles to detect crashes and logical errors in the black-box setting:

1. Protocol Side-Channel Crash Detection: CoreCrisis sends specific probing messages (e.g., RegistrationRequest with last-used SUPI for AMF, PDUSessionEstablishmentRequest for SMF) that, under normal conditions, guarantee a response according to specifications. If no response is observed, it infers the NF has crashed or entered a problematic state. This method is reliable due to mandated responses for these messages.

1. Logical Error Detection: CoreCrisis leverages the protocol FSM extracted from technical specifications (Figure 4) to detect logical deviations. It performs a two-level checking process:

• Key State Labeling: By analyzing input/output pairs in the learned FSM and comparing them with key protocol transitions, CoreCrisis automatically labels each learned state with its corresponding key protocol state (e.g., "Deregistered," "Registration-Initiated").
• Error Identification:
• Path Discrepancies: CoreCrisis detects errors when different paths leading to the same learned state result in conflicting labels (e.g., state a5 in Figure 3 being labeled 'N' via one path and 'S' via another, indicating an authentication bypass).
• Protocol Verification: On top of the labeled FSM, CoreCrisis performs protocol verification based on the expected behaviors for each key state (Table 1). For example, it checks if unprotected messages are accepted after a 5G common procedure, which is a violation. This ensures compliance with specifications and records deviations (D1-D7).

Demo / Proof of Concept

While CoreCrisis is a framework presented in a peer-reviewed paper rather than a live conference demonstration, its effectiveness as a security testing tool is thoroughly demonstrated through its evaluation results. The identified vulnerabilities and deviations serve as concrete proof-of-concept for its capabilities. The research team applied CoreCrisis to Open5GS, free5GC, OAI-CN-5G (all open-source), and a commercial Amarisoft 5GC implementation, uncovering a range of critical flaws.

For instance, the authentication bypass (P2) in OAI-CN-5G (illustrated in Figure 6) perfectly demonstrates CoreCrisis's ability to find deep, stateful vulnerabilities. The attack sequence involved sending a plaintext SecurityModeComplete message after an AuthenticationRequest but before the expected AuthenticationResponse and Security Mode Command. OAI-CN-5G incorrectly accepted this plaintext message, leading to a plaintext RegistrationAccept and allowing the attacker to complete registration without proper authentication. This vulnerability was only discoverable because CoreCrisis dynamically learned the unexpected transition from state a1 to a5 (Figure 3) triggered by the mutated SecurityModeComplete message, which was not part of the initial benign symbol set. This highlights the power of dynamic FSM refinement and state-aware mutation.

Another significant finding was the identity spoofing vulnerability (P3) in free5GC. CoreCrisis discovered this in a dynamically learned state (a8 in Figure 3) following a mutated securityModeComplete message. By removing the user identity field, CoreCrisis prompted the core network to send an identityRequest. Subsequent testing of this newly discovered state revealed that free5GC accepted mutated messages containing invalid IMEI/IMEISV values. This oversight could allow attackers to bypass device blacklists or exploit systems relying on IMEI for access control, showcasing CoreCrisis's ability to uncover subtle validation flaws through state-specific fuzzing.

The numerous crashing vulnerabilities (C1-C13) further attest to CoreCrisis's robustness. For example, the segmentation fault in Amarisoft 5GC (C13), triggered by a RegistrationRequest with an invalidly long SUCI, demonstrates its capacity to find classic memory safety issues even in commercial, black-box binaries. Similarly, crashes related to improper Security Header Type (SHT) handling (C1, C6, C8, C9, C10) across multiple implementations highlight common programming errors where implementations perform byte operations without adequate input validation, leading to out-of-bounds reads or assertion failures. The crashing input 0x7E025F74 for vulnerability C6 in free5GC, a plaintext SecurityModeReject with an integrity-protected and ciphered SHT but insufficient length, is a clear example of how precisely crafted malicious inputs can trigger crashes due to missing length checks.

The identified logical deviations (D1-D7), such as Open5GS's incorrect state transition (D1) or the early acceptance of protected messages by Open5GS, OAI-CN-5G, and Amarisoft (D3), demonstrate CoreCrisis's capability to detect subtle non-compliance with 3GPP specifications. While not always immediately exploitable, these deviations represent vulnerabilities that could be chained with other flaws or used for network fingerprinting and evasion tactics, proving the value of a comprehensive, specification-aware testing framework.

Defensive Implications

The findings presented by CoreCrisis offer crucial insights for 5G core network operators, developers, and standardization bodies to enhance the security posture of 5GC deployments.

1. Prioritize Patching and Vulnerability Management: Network operators must immediately apply patches for the identified CVEs (e.g., CVE-2024-34476, CVE-2024-33232, CVE-2024-22728, CVE-2024-33236, CVE-2024-33241) and other reported vulnerabilities. Regular security audits and prompt patching cycles for all NFs are essential to prevent DoS, authentication bypass, and billing fraud attacks. The fact that patches for 11 of 16 identified vulnerabilities are already merged underscores the urgency and impact of these findings.

1. Enhance Input Validation and State Management: Developers of 5GC Network Functions (NFs) must implement robust and comprehensive input validation across all message fields, paying particular attention to length checks, data types, and value constraints. The crashes related to malformed message fields (e.g., oversized SUCI, missing length checks for PDUSessionModificationRequest) highlight a critical need for stricter parsing and validation logic. Furthermore, NF implementations must rigorously adhere to protocol state transitions and requirements. The authentication bypass (P2) and incorrect state transitions (D1) demonstrate that improper state handling can lead to severe logical flaws.

1. Clarify 3GPP Specifications: Standardization bodies like 3GPP should review and clarify ambiguous or underspecified clauses in the 5G technical specifications (e.g., TS 24.501, clauses 4.4.2.5 and 5.4.2.1, which contributed to D3). Clearer specifications will reduce misinterpretations by implementers, thereby minimizing the introduction of logical deviations and potential vulnerabilities.

1. Adopt Advanced Stateful Fuzzing: Operators and developers should integrate advanced stateful black-box fuzzing frameworks like CoreCrisis into their continuous integration/continuous deployment (CI/CD) pipelines and security testing methodologies. Relying solely on static analysis or basic fuzzing is insufficient to uncover deeply rooted, state-dependent vulnerabilities. The iterative learning and dynamic refinement capabilities of CoreCrisis are essential for exploring the complex state spaces of 5GC.

1. Implement Comprehensive Monitoring and Anomaly Detection: Network operators should deploy robust monitoring solutions capable of detecting unusual message sequences, unexpected state transitions, and anomalous responses from NFs. While CoreCrisis helps prevent vulnerabilities, real-time monitoring can detect active exploitation attempts or previously undiscovered zero-day flaws. Deviations like D1-D7, though not always directly exploitable, can serve as indicators of suspicious activity or fingerprinting attempts.

1. Secure Device Identifiers: The identity spoofing vulnerability (P3) highlights the need for rigorous validation of device identifiers like IMEI/IMEISV. Systems relying on these identifiers for blacklisting, access control, or other security functions must ensure their integrity and authenticity, not solely trusting client-provided values.

By addressing these defensive implications, the 5G ecosystem can significantly bolster its resilience against sophisticated attacks targeting the core network, ensuring the reliability, integrity, and privacy of critical communication services.

Key Takeaways

• CoreCrisis is the first systematic stateful black-box fuzzing framework for 5G core networks, overcoming limitations of prior methods through its dynamic, two-step iterative learning and fuzzing approach.
• The framework introduces novel techniques: divide-and-conquer FSM learning to manage complexity by splitting NFs, and property-driven equivalence checking which significantly accelerates FSM learning by reducing query counts by up to 97.06%.
• CoreCrisis effectively identifies critical vulnerabilities: it uncovered 3 exploitable protocol violations (including authentication bypass and identity spoofing), 13 crashing vulnerabilities leading to DoS, and 7 logical deviations across open-source and commercial 5GC implementations, leading to 8 assigned CVEs.
• Its state-aware mutation strategy and grammar-aware message construction enable the generation of syntactically and semantically valid, yet malicious, test inputs, crucial for deep state exploration.
• The dynamic FSM refinement mechanism allows CoreCrisis to adapt to newly discovered states and transitions during fuzzing without re-learning, making it highly effective at uncovering multi-mutation vulnerabilities.
• Black-box vulnerability detection is achieved through protocol side-channel crash detection and a two-level logical error identification process that labels learned FSM states with protocol states and verifies expected behaviors against specifications.

About the Speaker(s)

The research presented in this paper was a collaborative effort by a team of academics from The Pennsylvania State University. The authors include Yilu Dong, Tianchang Yang, Abdullah Al Ishtiaq, Syed Md Mukit Rashid, Ali Ranjbar, Kai Tu, Tianwei Wu, Md Sultan Mahmud, and Syed Rafiul Hussain. Their collective expertise in network security, cellular technologies, and automated testing frameworks contributed to the development and evaluation of CoreCrisis.