Search papers, labs, and topics across Lattice.
The paper demonstrates that 5G user equipment (UE) is vulnerable to attacks using syntactically valid but semantically inconsistent Radio Resource Control (RRC) messages before authentication. They found that violating specification-level field constraints and cross-field dependencies can crash baseband implementations. To address this, they introduce Constraint-Guided Semantic Testing (ConSeT), a framework that extracts specification-level constraints and uses an LLM to infer cross-field dependencies for targeted semantic violation generation.
Forget syntax fuzzing – semantic inconsistencies in pre-authentication 5G signaling are a goldmine of exploitable vulnerabilities, with this work uncovering 7 new CVEs in commercial smartphones.
Modern 5G user equipment (UE) processes Radio Resource Control (RRC) configuration messages during early control-plane exchanges, before authentication and integrity protection are established. Prior work for testing 5G UEs has largely focused on constructing syntactically invalid inputs. In contrast, we show that syntactically valid but semantically inconsistent messages, which violate specification-level field constraints or cross-field dependencies, can drive baseband implementations into invalid states, triggering assertion failures or modem crashes. These findings reveal semantic inconsistencies in pre-authentication signaling as a critical yet underexplored attack surface in 5G UE implementations. To address this gap, we present Constraint-Guided Semantic Testing (ConSeT), a framework that systematically extracts specification-level constraints and leverages them to generate targeted semantic violations for testing 5G UEs. ConSeT decodes RRC messages into structured fields, derives schema-based rules, infers cross-field dependencies using a Large Language Model (LLM) in an evidence-bounded manner, and produces syntactically valid test cases that intentionally violate semantic constraints. We evaluate ConSeT on both commercial and open-source 5G UEs. On commercial smartphones, it uncovers 7 previously unknown vulnerabilities through responsible disclosure, including 3 high-severity CVEs, affecting 64 chipset models and over 542 commercially available smartphone models. On the open-source OAI UE, ConSeT additionally triggers 29 distinct crash sites.
