Executive Summary

Ella Core is a 5G core designed for private networks. Before version 1.10.0, it did not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values.

This means a malicious gNB (next generation NodeB) can send a specially crafted PathSwitchRequest message to overwrite the stored UE security capabilities for any UE with arbitrary values.

This vulnerability was fixed in version 1.10.0.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a malicious gNB to overwrite the stored UE security capabilities with arbitrary values.

According to the CVSS v3.1 score of 6.1, the impact includes low integrity and low availability impacts, meaning an attacker could potentially alter security settings and disrupt service availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Ella Core to version 1.10.0 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a malicious gNB sending a crafted NGAP PathSwitchRequest message to overwrite stored UE security capabilities in Ella Core versions prior to 1.10.0.

Detection can focus on monitoring NGAP PathSwitchRequest messages for unusual or unexpected UE Security Capabilities values that differ from locally stored values.

Since the fix includes logging mismatches between received and stored UE Security Capabilities, reviewing logs for such events can help detect exploitation attempts.

Specific commands are not provided in the available resources, but network monitoring tools or packet capture utilities (e.g., tcpdump or Wireshark) can be used to capture and analyze NGAP PathSwitchRequest messages for anomalies.

For example, using tcpdump to capture NGAP traffic on the relevant interface and port could be done with a command like: tcpdump -i <interface> -w capture.pcap port <NGAP_port>

Subsequent analysis of the capture file with Wireshark or a custom script could identify PathSwitchRequest messages with UE Security Capabilities that do not match expected values.

Useful 0 Not Useful 0