Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces Buckler, a framework that allows mobile network operators (MNOs) to implement temporary and reversible hotfixes in 5G radio access networks (RANs) to address vulnerabilities while awaiting permanent solutions. By placing reusable hooks at standardized L2/L3 channel boundaries, Buckler enables three preventive actions—DROP, MODIFY, and RELEASE—against identified attacks, effectively mitigating risks without extensive changes to existing infrastructure. The evaluation reveals that Buckler can successfully deploy hotfixes for 20 out of 64 identified attacks, demonstrating its practicality and highlighting the limitations of RAN-only prevention strategies.
Operator-empowered hotfixing can effectively mitigate 5G RAN vulnerabilities in real-time, offering a critical stopgap during lengthy patching processes.
Cellular protocol vulnerabilities can remain exploitable for months or years while standards bodies, vendors, and mobile network operators (MNOs) coordinate permanent fixes. We present Buckler, a framework that enables an MNO to deploy temporary, local, and reversible hotfixes in its radio access network (RAN) during this exposure window. Buckler places reusable hooks at standardized L2/L3 channel boundaries and exposes a closed, stateful match-action interface with three preventive actions: DROP, MODIFY, and RELEASE. We evaluate whether this bounded design provides useful coverage without requiring extensive changes to existing RANs. From 23 papers, we identify 64 attacks rooted in standard L2/L3 protocol behavior, of which 43 provide a preventive intervention point at the RAN, and we construct Buckler hotfixes for 20 of them. All 20 hotfixes use the same rule vocabulary and only five standardized channel hooks, while the unsupported attacks expose endpoint dependencies that a RAN cannot satisfy alone. We implement the five hooks on srsRAN and OpenAirInterface with small, structurally similar changes, and demonstrate all three actions against representative availability and privacy attacks. These results establish operator-empowered hotfixing as a practical and portable interim defense and delineate the architectural limits of RAN-only prevention.