CovFUZZ: Coverage-based fuzzer for 4G&5G protocols

TL;DR

This paper introduces an automated fuzzing framework designed to test the security of 4G and 5G Attach procedure implementations, and provides a comprehensive solution for uplink and downlink fuzzing in 4G, as well as downlink fuzzing in 5G, while supporting fuzzing on all layers except the physical layer.

Abstract

4G and 5G represent the current cellular communication standards utilized daily by billions of users for various applications. Consequently, ensuring the security of 4G and 5G network implementations is critically important. This paper introduces an automated fuzzing framework designed to test the security of 4G and 5G attach procedure implementations. Our framework provides a comprehensive solution for uplink and downlink fuzzing in 4G, as well as downlink fuzzing in 5G, while supporting fuzzing on all layers except the physical layer. To guide the fuzzing process, we introduce a novel algorithm that assigns probabilities to packet fields and adjusts these probabilities based on coverage information from the device-under-test (DUT). For cases where coverage information from the DUT is unavailable, we propose a novel methodology to estimate it. When evaluating our framework, we first run the random fuzzing experiments, where the mutation probabilities are fixed throughout the fuzzing, and give an insight into how those probabilities should be chosen to optimize the Random fuzzer to achieve the best coverage. Next, we evaluate the efficiency of the proposed coverage-based algorithms by fuzzing open-source 4G stack (srsRAN) instances and show that the fuzzer guided by our algorithm outperforms the optimized Random fuzzer in terms of DUT's code coverage. In addition, we run fuzzing tests on 12 commercial off-the-shelf (COTS) devices. In total, we discovered vulnerabilities in 10 COTS devices and all of the srsRAN 4G instances.

Figures (17)

• Figure 1: 4G/5G control plane stack.
• Figure 2: Attach procedure in 4G and 5G.
• Figure 3: The illustration of our fuzzing framework architecture for the downlink 4G/5G fuzzing. The steps shown in the figure outline the fuzzing flow for one packet. The architecture for uplink 4G fuzzing is similar and it can be achieved by inverting the left part of the figure, i.e. the interception points are in srsUE, and srsENB/srsEPC serve as the DUT(s).
• Figure 4: An example of extracting the value of the lte-rrc.maxHARQ_Tx field from the intercepted 4G RRC Connection Setup packet.
• Figure 5: Hierarchical structure of a Seed.