网络与信息安全学报 ›› 2024, Vol. 10 ›› Issue (1): 156-168.doi: 10.11959/j.issn.2096-109x.2024006

• 学术论文 • 上一篇    

针对5G核心网协议的自动化漏洞挖掘方法

吴佩翔, 张志龙, 陈力波, 王轶骏, 薛质   

  1. 上海交通大学网络空间安全学院，上海 200240
  • 修回日期:2023-04-01 出版日期:2024-02-01 发布日期:2024-02-01
  • 作者简介:吴佩翔（1992− ），男，新疆伊宁人，上海交通大学硕士生，主要研究方向为自动化代码审计、5G安全、容器安全
    张志龙（1981− ），男，江苏南通人，上海交通大学博士生，主要研究方向为网络空间安全、计算机外设安全
    陈力波（1985− ），男，江西广丰人，上海交通大学高级工程师，主要研究方向为软件与系统安全、物联网安全、虚拟化安全
    王轶骏（1980− ），男，上海人，上海交通大学工程师，主要研究方向为网络与系统安全、网络攻防对抗
    薛质（1971− ），男，江苏苏州人，博士，上海交通大学教授、博士生导师，主要研究方向为计算机通信网、网络攻防与评测、安全主动网
  • 基金资助:
    国家重点研发计划(2022QY1702)

Automated vulnerability discovery method for 5G core network protocol

Peixiang WU, Zhilong ZHANG, Libo CHEN, Yijun WANG, Zhi XUE   

  1. School of Cyber Science and Engineering, Shanghai Jiao Tong University, Shanghai 200240, China
  • Revised:2023-04-01 Online:2024-02-01 Published:2024-02-01
  • Supported by:
    The National Key R＆D Program of China(2022QY1702)

在线阅读

82

pdf下载

262

摘要：

随着5G在全球范围内的广泛商用，5G网络安全问题广泛受到关注。针对5G核心网协议的自动化漏洞挖掘手段主要以黑盒模糊测试为主，但由于5G核心网协议设计复杂，黑盒模糊测试存在效率低、通用性差、拓展性不足等问题，不能有效检测到 5G 核心网协议安全漏洞。针对上述问题，深入了解 5G 核心网架构和重点接口协议的工作原理，总结在5G核心网场景下基于静态分析的自动化漏洞挖掘方法相较传统黑盒模糊测试方法的优势。对5G核心网的开源解决方案进行了源代码审计，发现在 5G 核心网协议实现中一类变量生命周期管理不当而导致的内存泄露安全问题，可导致5G核心网网元被拒绝服务攻击。基于此，提出了针对此类安全问题的通用漏洞模型，设计并实现了基于控制流和数据流混合分析的自动化漏洞挖掘方法。通过实验对该方法进行了有效性测试和效率评估，成功挖掘到了通用 5G 开源解决方案——Open5GS 中的5个未公开安全漏洞，涵盖多个接口协议应用场景，获得了4个CVE 编号。通过模拟环境，验证了该系列漏洞的影响范围广且利用条件低，充分证明了所提自动化漏洞挖掘方法的有效性，并向相关厂商进行了披露。

关键词: 5G核心网, 开源解决方案, 协议安全, 静态分析, 漏洞挖掘

Abstract:

With the widespread development of fifth-generation (5G) mobile communication technology, concerns regarding 5G network security have also increased.Blackbox fuzzing is a commonly used method for automated vulnerability discovery in software security.However, applying dynamic approaches like fuzzing to discover vulnerabilities in the complex design of 5G core network protocols poses challenges such as low efficiency, poor versatility, and lack of scalability.Therefore, a novel static method to examine the open-source solution of the 5G core network was proposed.Through this method, a series of memory leak security issues caused by improper variable life cycle management were identified, which can lead to denial-of-service attacks on the 5G core network.To summarize these weaknesses, a general vulnerability model and an automated vulnerability discovery method called HoI were presented, which utilized hybrid analysis based on control and data flow.By successfully discovering five zero-day bugs in Open5GS, an open-source solution for the 5G core network, vulnerabilities that cover practical application scenarios of multiple interface protocols in the 5G core network were identified.These vulnerabilities have wide-ranging impact, are highly detrimental, and can be easily exploited.They have been reported to the vendor and assigned four Common Vulnerabilities and Exposures (CVE) numbers, demonstrating the effectiveness of this automated vulnerability discovery method.

Key words: 5G core network, open-source solution, protocol security, static analysis, vulnerability discovery

中图分类号: 

No Suggested Reading articles found!