Overcoming State: Finding Baseband Vulnerabilities by Fuzzing Layer-2

Overcoming State: Finding Baseband Vulnerabilities by Fuzzing Layer-2

Speakers: Marius, Dion

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=mXijb6ckU2c

Overview

In this insightful talk at Black Hat USA, Marius and Dion unveiled their pioneering research into uncovering vulnerabilities within the cellular basebands of modern smartphones. Titled "Overcoming State: Finding Baseband Vulnerabilities by Fuzzing Layer-2," their presentation highlighted a novel approach to security analysis, specifically targeting Layer 2 (the Data Link Layer) of the cellular communication stack. This work stands in contrast to much of the prior research, which predominantly focused on higher layers, particularly Layer 3 (the Network Layer). The speakers emphasized the critical nature of baseband security, given their intricate proprietary codebases and their direct exposure to over-the-air and internet packets, making them a prime target for attackers.

The core innovation of their research lies in successfully applying fuzzing techniques to the inherently complex and stateful Layer 2 protocols. Despite directing their fuzzing efforts at Layer 2, a remarkable and counter-intuitive discovery was made: all the critical crashes they identified were located in Layer 3. This finding underscores the interconnectedness of the cellular stack layers and suggests that vulnerabilities in lower layers can have cascading effects, manifesting as exploitable flaws in higher-level components. The talk detailed the challenges encountered in constructing effective fuzzing tasks and validating the results over the air on real devices, ultimately demonstrating the practical impact of these vulnerabilities through observable device behavior, such as lost connections.

Background

▶ Watch: Introduction: Overcoming state by fuzzing Layer 2 (0:00)

Cellular basebands, often referred to as the Cellular Processor (CP), are distinct from the smartphone's Application Processor (AP), which runs the main operating system like Android. The CP is a highly specialized piece of hardware and software, solely responsible for handling all radio connectivity and implementing the complex layers of the cellular communication stack. These basebands are characterized by millions of lines of highly proprietary code, often containing significant legacy components, intricate parsers, and obscure features. They operate on custom firmware, typically deploying a Real-Time Operating System (RTOS).

The RTOS provides fundamental operating system functionalities tailored for embedded systems, including a scheduler, timers, interrupt handling, and the concept of tasks. These tasks are analogous to processes in a desktop operating system and communicate extensively with each other via messaging mechanisms provided by the RTOS. Incoming over-the-air messages are dispatched to specific tasks, which then process and pass these messages across the different layers of the communication stack through this inter-task messaging framework. This architecture, while efficient for real-time communication, introduces complex state management and inter-process dependencies that can be challenging to secure.

Historically, baseband security research, particularly in the realm of memory vulnerabilities and corruptions, has largely concentrated on Layer 3 and above. The speakers noted that recent years (2023-2024) have seen a surge in baseband research, citing examples like "Over the Air, Under the Radar" and "Cracking the 5G Fortress." However, at the inception of their work, very few studies had specifically addressed Layer 2 vulnerabilities. They acknowledged two notable exceptions: "Five School," which involved over-the-air fuzzing and identified Layer 2 bugs, and a work by "Task" that demonstrated actual exploitation of Layer 2 baseband bugs. Recognizing this gap, Marius and Dion deliberately chose to explore Layer 2.

Their strategic decision to focus on GSM Layer 2 (2G technology) was driven by its designation as the "lowest hanging fruit" from an attacker's perspective. Unlike more modern cellular generations such as 4G or 5G, GSM lacks mutual authentication between the mobile phone and the base station. This critical security design flaw allows an attacker to easily set up a rogue base station and compel nearby phones to connect to it without the phone being able to verify the base station's legitimacy. This absence of mutual authentication significantly simplifies the attack setup, making GSM an ideal testbed for developing and refining Layer 2 fuzzing techniques without the added complexity of cryptographic authentication challenges.

Key Findings

▶ Watch: Understanding baseband architecture and attack surface (1:15)

The primary and most compelling finding of this research is the discovery that fuzzing Layer 2 of cellular basebands consistently resulted in crashes located in Layer 3. This outcome was unexpected, as the fuzzing efforts were specifically designed to target the protocols and state machines of the Data Link Layer. The observation that vulnerabilities triggered at Layer 2 manifested as critical failures in Layer 3 highlights a fundamental aspect of baseband architecture: the tight coupling and complex message passing between different layers within the RTOS environment. A malformed or unexpected Layer 2 message, while processed initially by Layer 2 tasks, can lead to corrupted state, incorrect assumptions, or malformed data structures that are subsequently passed up the stack, ultimately triggering a memory corruption or logic error in a Layer 3 component.

The speakers successfully triggered these crashes over the air on real phones, demonstrating the practical impact of their findings. The visual evidence of connection bars disappearing and the phone losing its cellular connection served as a tangible proof of concept for the discovered vulnerabilities. This real-world validation is crucial, as it confirms that the bugs are not merely theoretical or confined to an emulated environment but can be activated remotely under realistic conditions. While specific CVE numbers, tool names, or exact percentages of bug types were not detailed in the provided transcript, the overarching finding points to a significant attack surface in a critical component of every smartphone. The research effectively proves that Layer 2, despite its lower-level nature, is a fertile ground for discovering severe vulnerabilities that can impact higher layers, challenging the traditional focus of baseband security research.

Technical Deep Dive

▶ Watch: Baseband software: RTOS, tasks, and message dispatch (2:00)

The technical core of Marius and Dion's research revolves around their methodology for fuzzing Layer 2 of cellular basebands, specifically within the GSM (2G) context. The choice of Layer 2 introduces significant technical hurdles compared to fuzzing higher layers. Layer 2 protocols are inherently stateful, meaning the correct processing of a packet often depends on the sequence of previously received packets and the internal state of the communication session. Overcoming this "state" is a central challenge in effective Layer 2 fuzzing, as simply sending random data is unlikely to reach deep code paths without proper protocol sequencing. While the talk did not extensively detail the specific techniques employed to "overcome state," it implies a sophisticated fuzzer capable of generating valid protocol sequences while introducing mutations at critical points.

Baseband firmware, running on a Real-Time Operating System (RTOS), presents a unique environment for security analysis. The RTOS is responsible for managing system resources, scheduling tasks, and facilitating inter-task communication via messaging mechanisms. When a cellular message arrives over the air, it is first processed by the lower layers (physical layer, Layer 1) and then passed as a message to a relevant Layer 2 task within the RTOS. This task processes the Layer 2 protocol data unit (PDU), updating its internal state, and potentially generating new messages to be sent to other tasks, either within Layer 2 or to higher layers like Layer 3. The intricate web of inter-task messaging and shared memory (or message queues) is a critical area where vulnerabilities can arise. A malformed Layer 2 message could, for instance, corrupt a buffer that is later accessed by a Layer 3 task, or it could trigger an unexpected state transition that leads to a logic error or memory corruption in a higher-level protocol handler.

The decision to target GSM Layer 2 was technically motivated by its relative simplicity and lack of mutual authentication. GSM's Layer 2, primarily the LAPDm (Link Access Procedure on the Dm channel) protocol, is responsible for reliable data transfer over the air interface. It handles framing, error detection, flow control, and sequence numbering. Fuzzing these aspects requires an understanding of the protocol's state machine to ensure that mutated inputs are delivered in a context where they might be processed rather than simply dropped as invalid. The absence of mutual authentication in GSM means that the researchers could establish a connection with the target phone using a rogue base station without needing to bypass complex cryptographic challenges, allowing them to focus purely on the Layer 2 protocol implementation within the baseband. This simplifies the setup for sending arbitrary, fuzzed Layer 2 messages directly to the target device.

The process of confirming results over the air is another critical technical aspect. While initial fuzzing might occur in an emulated or simulated environment for speed and control, real-world baseband behavior can differ. Confirming vulnerabilities over the air involves transmitting the crafted, crash-inducing Layer 2 messages from a software-defined radio (SDR)-based rogue base station to a physical smartphone. Observing the connection loss or device reboot directly validates the vulnerability's exploitability in a live environment. This dual approach of emulation for discovery and over-the-air for confirmation is essential for robust baseband security research.

The intriguing finding that Layer 2 fuzzing leads to Layer 3 crashes suggests a deep coupling between these layers. This could be due to:

1. Shared Memory/Buffers: Layer 2 tasks might populate data structures or buffers that are then directly consumed by Layer 3 tasks, and a Layer 2 vulnerability could lead to buffer overflows or underflows that corrupt Layer 3-owned memory.
2. Incorrect Data Propagation: Layer 2 might parse a field incorrectly, but instead of crashing, it passes this malformed data (e.g., an incorrect length field or a corrupted pointer) to Layer 3, which then attempts to process it, leading to a crash.
3. State Mismatch: A Layer 2 vulnerability could put the baseband into an unexpected state, and when Layer 3 attempts to transition based on its own state machine, it encounters an inconsistency that leads to an error.

The talk alluded to challenges in constructing fuzzing tasks and dealing with roadblocks. These likely include issues such as:

• State management: How to correctly infer and maintain the complex internal state of the baseband's Layer 2 protocols to ensure fuzz inputs are meaningful.
• Feedback mechanisms: How to get coverage feedback from a proprietary RTOS on an embedded system to guide the fuzzer.
• Crash detection: Reliably detecting crashes on a remote device over the air and correlating them back to specific fuzz inputs.
• Timing constraints: Real-time protocols have strict timing requirements, and fuzzing must account for these to avoid simply triggering timeouts instead of processing errors.

Without specific tool names or detailed implementation specifics, it's clear the researchers developed a sophisticated framework to tackle these inherent complexities of baseband Layer 2 fuzzing.

Demo / Proof of Concept

▶ Watch: Identifying research gap: Underexplored Layer 2 vulnerabilities (4:00)

The speakers demonstrated the tangible impact of their findings by showing a real-world scenario where a smartphone connected to their rogue base station experienced a critical failure. They described observing the phone's connection bars disappearing, indicating a loss of cellular service. This visual cue directly correlated with the successful triggering of crashes over the air on actual phones. While the transcript does not provide intricate details of the demo setup or a specific video description, the mention of "connection bars going to a connection disappearing" clearly illustrates a successful Denial of Service (DoS) attack against the phone's cellular capabilities, initiated by the fuzzed Layer 2 messages. This practical demonstration served as irrefutable proof that their discovered vulnerabilities were not merely theoretical but had immediate, observable consequences on target devices.

Defensive Implications

▶ Watch: Methodology: Fuzzing GSM Layer 2 due to authentication (4:45)

The findings presented by Marius and Dion carry significant defensive implications for smartphone manufacturers, baseband vendors, and even network operators. The revelation that Layer 2 fuzzing can uncover vulnerabilities that manifest as Layer 3 crashes underscores the need for a holistic approach to baseband security, moving beyond a sole focus on higher layers.

1. Enhanced Layer 2 Security Audits: Baseband vendors must intensify their security auditing and testing efforts on Layer 2 implementations. This includes rigorous code reviews, static analysis, and, crucially, comprehensive fuzzing campaigns specifically tailored for stateful Layer 2 protocols like LAPDm. The "overcoming state" challenge highlighted in the talk suggests that traditional, stateless fuzzing might be insufficient.
2. Secure RTOS and Inter-Task Communication: The RTOS and its messaging mechanisms are central to how different layers interact. Developers must ensure that inter-task messaging is robust against malformed data, buffer overflows during message passing, and unexpected state transitions. Secure coding practices for RTOS tasks, including rigorous input validation and boundary checks for all incoming messages, are paramount.
3. Deprioritization/Decommissioning of 2G Networks: The inherent lack of mutual authentication in GSM (2G) makes it a persistent security risk. Network operators should accelerate the process of deprioritizing or entirely decommissioning 2G networks where possible. For regions where 2G remains essential, operators and manufacturers should implement stricter monitoring for rogue base stations and educate users about the risks of connecting to insecure networks.
4. Hardware-Assisted Security Features: Modern basebands could benefit from hardware-assisted memory protection mechanisms (e.g., Memory Protection Units (MPUs) or Memory Management Units (MMUs)) even within the RTOS context, to isolate tasks and prevent one layer's vulnerability from directly corrupting another's memory space.
5. Supply Chain Security: Given the proprietary nature of baseband code, smartphone manufacturers are heavily reliant on baseband vendors. This research emphasizes the need for stringent security requirements and rigorous third-party auditing of baseband firmware throughout the supply chain.
6. Continuous Research and Collaboration: The rapid evolution of baseband research, as noted by the speakers, necessitates continuous investment in security research and greater collaboration between academia, industry, and independent researchers to identify and mitigate emerging threats.
7. Patching and Update Mechanisms: Manufacturers must ensure efficient and timely patching mechanisms for baseband firmware. Discovered vulnerabilities, even if in obscure layers, can have critical impacts and require prompt remediation.

By addressing these defensive implications, the industry can collectively work towards building more resilient and secure cellular communication stacks within our smartphones.

Key Takeaways

• Layer 2 of cellular basebands is a critical and under-researched attack surface: While prior work often focused on Layer 3, this research demonstrates the significant vulnerabilities present in the Data Link Layer.
• Fuzzing Layer 2 can uncover vulnerabilities that manifest in higher layers: The unexpected finding of Layer 3 crashes from Layer 2 fuzzing highlights the intricate interdependencies within the baseband's software stack.
• GSM (2G) remains a "lowest hanging fruit" for attackers: The lack of mutual authentication in 2G simplifies the setup of rogue base stations, making it an accessible target for initial vulnerability research and potential exploitation.
• Overcoming state is crucial for effective baseband fuzzing: The inherent statefulness of Layer 2 protocols requires sophisticated fuzzing techniques that can navigate protocol states to reach deeper code paths.
• Real-time operating systems (RTOS) and inter-task messaging are key areas for vulnerability: The way baseband tasks communicate and manage data within the RTOS environment is a significant source of potential security flaws.
• Over-the-air validation is essential for real-world impact: Confirming vulnerabilities on physical devices via rogue base stations provides undeniable proof of exploitability and practical consequences like denial of service.

About the Speaker(s)

The talk "Overcoming State: Finding Baseband Vulnerabilities by Fuzzing Layer-2" was presented by Marius and Dion. Based on the provided transcript, no specific titles or company affiliations were mentioned for either speaker. They are evidently experienced security researchers with a deep understanding of cellular communication protocols and embedded system security, particularly within the context of smartphone basebands. Their work highlights a commitment to advancing the state of the art in baseband vulnerability research, focusing on previously less explored areas of the cellular stack.