Executive Summary

The vulnerability exists in Ella Core, a 5G core designed for private networks, prior to version 1.10.0. It fails to enforce security rules on concurrent running of security procedures as defined in TS 33.501 §6.9.5.1. Specifically, it can send a NAS Security Mode Command while an N2 handover is still pending, or vice versa. This concurrency causes a KgNB mismatch between the User Equipment (UE) and the target gNB, which leads to handover failure.

Triggering this vulnerability requires a stalled gNB and a re-registration race condition.

The issue was fixed in version 1.10.0 of Ella Core.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause handover failures in 5G private networks using Ella Core prior to version 1.10.0. The KgNB mismatch between the UE and target gNB disrupts the handover process, potentially leading to degraded network performance or dropped connections during mobility events.

The CVSS base score of 3.7 indicates a low severity impact, with limited integrity and availability impact but no confidentiality impact.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Ella Core version 1.10.0. Immediate mitigation involves upgrading to version 1.10.0 or later to ensure enforcement of security rules on concurrent running of security procedures.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves concurrent execution of NAS Security Mode Command and N2 handover procedures, which leads to a KgNB key mismatch and handover failure. Detection would focus on monitoring for these concurrent procedures and failed handovers caused by key mismatches.

Since the vulnerability requires a stalled gNB and a re-registration race condition, network monitoring tools should look for abnormal handover failures and repeated re-registrations in the affected Ella Core versions prior to 1.10.0.

Specific commands are not provided in the available resources. However, network operators could use logs from the Ella Core system and gNBs to identify instances where a NAS Security Mode Command is sent while an N2 handover is still pending, or vice versa.

Commands might include querying logs or status of handover procedures and security commands on the network elements, but no explicit commands are detailed in the provided information.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0