Stateful Analysis and Fuzzing of Commercial Baseband Firmware

Stateful Analysis and Fuzzing of Commercial Baseband Firmware

Speakers: Ali Ranjbar, Tianchang Yang, Kai Tu, Saaman Khalilollahi, Syed Rafiul Hussain, Pennsylvania State

Conference: IEEE S&P

YouTube: https://www.youtube.com/watch?v=TeIJmPkJvWA

Overview

In this compelling talk from IEEE S&P, Ali Ranjbar, alongside his colleagues from Pennsylvania State, unveiled Loris, a novel framework designed for the stateful analysis and fuzzing of commercial baseband firmware. The presentation meticulously detailed the inherent complexities and security vulnerabilities present in the dedicated processors responsible for handling cellular communications (2G to 5G) within our smartphones. Ranjbar underscored the critical nature of baseband security, highlighting how these often-overlooked components are susceptible to remote exploitation via malicious over-the-air (OTA) messages, leveraging memory-unsafe languages like C and C++ prevalent in their development.

The core problem addressed by Loris is the formidable challenge of uncovering deep, state-dependent vulnerabilities within baseband firmware. Traditional analysis and fuzzing techniques frequently falter due to the highly stateful and interdependent nature of baseband tasks, leading to issues like path explosion in symbolic execution or incomplete emulation in dynamic analysis. Loris introduces an innovative iterative symbolic analysis approach that systematically identifies crucial state variables and their preconditions, enabling deeper code exploration and the discovery of bugs previously unreachable by existing tools. The significance of this research lies not only in its technical ingenuity but also in its tangible impact, as Loris successfully uncovered seven new, exploitable vulnerabilities in commercial basebands, demonstrating real-world risks ranging from denial of service to potential remote code execution.

Background

▶ Watch: Introduction to bassbands and security challenges (0:00)

Basebands are specialized, real-time operating systems (RTOS) running on dedicated processors embedded within virtually every mobile phone. Their primary function is to manage all cellular communication protocols, from legacy 2G to the latest 5G standards. This involves intricate interactions with cell towers, handling a myriad of messages and hardware interfaces, such as SIM card access. Despite their critical role, baseband firmware is predominantly developed using memory-unsafe languages like C and C++, making them inherently vulnerable to common security flaws such as buffer overflows, integer overflows, and heap corruption.

The threat landscape for basebands is particularly concerning because vulnerabilities can be exploited remotely by attackers using malicious or fake base stations. By sending specially crafted over-the-air messages, an adversary can trigger these flaws, potentially disrupting service (denial of service) or, in more severe scenarios, escalating privileges to compromise the phone's main operating system. The complexity of baseband firmware is immense; a 5G baseband, for instance, can run over 150 tasks, each mapping to a specific protocol layer and managing distinct responsibilities, from OTA message processing to hardware interactions. These tasks are not isolated but are deeply stateful and highly interdependent, meaning their behavior is heavily influenced by prior events and internal states.

Prior attempts at baseband security analysis have faced significant hurdles. Tools like Firmwire and BaseSafe employ dynamic analysis to fuzz message handlers, but they often require extensive manual reverse engineering for partial emulation or struggle with full emulation if the target task isn't properly initialized. This limitation prevents them from reaching deep, state-dependent code paths. Another static analysis tool, BaseComp, is restricted to integrity checks and does not delve into behavioral vulnerabilities. The fundamental challenge lies in the statefulness: if an over-the-air message is sent to a task like the NAS (Non-Access Stratum) task when it's not in the correct internal state, the message will be immediately rejected. To reach vulnerable code, an analyzer must first understand and satisfy the specific preconditions that define the required state. These preconditions are governed by state variables, which are defined outside the message processing loop and persist across iterations, effectively remembering what the task has seen or done. Without a systematic way to identify and manipulate these state variables, uncovering deep state-dependent vulnerabilities remains an arduous and often impossible task, demanding prohibitive amounts of manual effort.

Key Findings

▶ Watch: Understanding the challenge of stateful bassband tasks (2:20)

Loris represents a significant leap forward in baseband security analysis, primarily through its innovative iterative symbolic analysis technique. This methodology directly addresses the long-standing challenge of statefulness in complex embedded systems, enabling the discovery of vulnerabilities that were previously out of reach for conventional tools. The framework's ability to automatically identify state variables and their necessary preconditions is a foundational contribution, making deep code exploration both feasible and scalable.

The practical impact of Loris is substantial and validated by its success in uncovering seven distinct, previously unknown, and exploitable vulnerabilities across commercial baseband firmware. These critical flaws included various memory corruption issues such as integer overflows, heap overflows, and stack overflows. Importantly, these vulnerabilities were not theoretical constructs; they were confirmed by the respective vendors and assigned CVEs, with several receiving high or critical severity ratings. One particularly alarming finding was a vulnerability that could be triggered by a malicious SMS message, highlighting the diverse attack vectors applicable to basebands.

To rigorously validate these discoveries, the research team went beyond mere theoretical analysis. They replayed Loris-generated malicious inputs using a modified open-source core network and transmitted them over-the-air to real, physical devices. In every instance, the targeted baseband crashed immediately, a failure confirmed through device logs and the visible disappearance of signal bars. While some bugs directly led to denial-of-service (DoS), the nature of memory corruption vulnerabilities means they can often be chained with other exploits to achieve more severe outcomes, such as remote code execution (RCE) or data leaks.

Beyond the specific vulnerabilities, Loris demonstrated superior performance in terms of code coverage compared to existing state-of-the-art tools. In basic block coverage evaluations conducted across five different commercial devices from two major vendors, Loris consistently outperformed both Firmwire and Grimoire. This achievement is particularly noteworthy given that Firmwire and Grimoire often rely on significant manual harnessing to achieve meaningful coverage. Even without explicit grammar support for message generation, Loris achieved similar coverage levels, albeit taking more time, underscoring the power and efficiency of its stateful analysis engine in navigating complex baseband logic.

Technical Deep Dive

▶ Watch: Loris's iterative symbolic analysis approach explained (3:30)

The fundamental technical challenge in analyzing baseband firmware stems from its profound statefulness. As illustrated by a simplified example reverse-engineered from a Samsung Shannon baseband, tasks often begin with initialization code and then enter a loop to process messages. Crucially, certain input messages will be rejected if the task's internal state variables — defined outside the message processing loop and persisting across iterations — do not satisfy specific conditions. In real-world firmware, satisfying these preconditions can require setting a dozen or more state variables to precise values.

Traditional symbolic execution, a powerful technique for exploring program paths, quickly succumbs to path explosion when applied to such complex, stateful systems. If every input and internal variable is made symbolic from the outset, the number of possible execution paths becomes astronomically large, rendering deep code exploration impractical. Loris overcomes this by introducing an innovative iterative symbolic analysis approach, designed to gradually uncover state variables and their preconditions while effectively managing path explosion.

The process within Loris's Analyzer component unfolds in several key steps:

1. Candidate State Variable Collection: Loris first analyzes the initialization code of a target message handler function. State variables, by definition, must be declared and potentially initialized outside the main message processing loop, as their values need to persist across multiple message interactions. The analyzer collects a set of variables identified in this initialization phase as potential state variables. For instance, in an X_message_handler function, it might initially identify three such candidates.

1. Iterative Traolic Analysis: This is the core mechanism for gradual code exploration. Instead of making everything symbolic at once, Loris iteratively refines its understanding of the necessary state.

• Iteration 1: When execution first reaches the X_message_handler function with a test input, Loris monitors variable usage. If a variable like message_type is assigned a value before it's ever read in a conditional context, its value doesn't persist across iterations in a meaningful way for state. Thus, it's removed from the candidate set of state variables. The analyzer then proceeds to branch conditions. If mm_press is used in a branch condition (e.g., if (mm_press == EXPECTED_VALUE)) but has not been assigned a value within the current message processing context, it is confirmed as a state variable. At this stage, since mm_press is not yet symbolic, it retains its initialized value (often zero), which might not satisfy the branch condition, preventing further progress down that specific path.
• Iteration 2: In the subsequent iteration, mm_press is now treated as symbolic. This allows the analyzer to explore both outcomes of the branch condition on mm_press. Loris records the specific value or range of values mm_press must take to satisfy the branch condition – this is a precondition. If another variable, mmas, is then encountered in a subsequent branch condition and is read without prior assignment in the current context, it's added to the set of confirmed state variables.
• Subsequent Iterations: The process repeats. mmas would become symbolic in the next iteration, allowing exploration of its branches and the recording of new preconditions. This iterative refinement continues until all preconditions required to reach a specific deep target function, such as radio_message_decode, are discovered.

This iterative approach is crucial for mitigating path explosion. By only making variables symbolic when they are confirmed as state-relevant and critical for path exploration, Loris avoids the combinatorial explosion that plagues naive symbolic execution. To further scale the analysis, Loris incorporates advanced techniques like state variable ranking (prioritizing which state variables to make symbolic) and checkpoint-based path pruning (discarding paths that are unlikely to lead to new code or vulnerabilities), though the talk did not delve into their specific details.

Loris's overall architecture comprises three main components:

• Analyzer: The core engine performing the iterative symbolic analysis, state variable ranking, and path pruning. It takes the baseband firmware binary as input.
• Emulator: This component builds upon the existing Firmwire framework but has been significantly extended to support newer Samsung 5G basebands. The emulator provides the necessary environment for executing firmware code during analysis and fuzzing.
• Fuzzer: A grammar-aware fuzzer is integrated to generate valid cellular messages, specifically NAS messages. This is a critical feature, as it eliminates the need for manual seed generation or complex harnessing, automatically producing inputs that conform to protocol specifications, thereby increasing the likelihood of reaching meaningful code paths and triggering vulnerabilities.

By combining these components, Loris creates a powerful framework capable of exploring complex, stateful code paths in baseband firmware that were previously inaccessible to other security analysis tools.

Demo / Proof of Concept

▶ Watch: Loris's discovery of real-world exploitable vulnerabilities (6:50)

While the talk did not feature a live, on-stage demonstration, the research team conducted a rigorous and impactful validation process that served as a robust proof of concept for Loris's capabilities. This validation directly demonstrated the real-world exploitability of the discovered vulnerabilities.

The process involved:

1. Input Generation: Loris generated a series of specially crafted, malicious over-the-air inputs designed to trigger the identified vulnerabilities (integer overflows, heap overflows, stack overflows).
2. Testbed Setup: A modified open-source core network was deployed. This network was configured to allow the transmission of the Loris-generated malicious messages in a controlled environment.
3. Over-the-Air Transmission: The malicious inputs were sent over-the-air to actual commercial mobile devices containing the vulnerable baseband firmware. The devices evaluated included five distinct models from two major vendors, confirming the broad applicability of the findings.
4. Impact Observation: In every instance, upon receiving the malicious over-the-air message, the target baseband immediately crashed. This critical failure was confirmed through multiple indicators:

• Device Logs: Detailed logs from the devices explicitly recorded the baseband crashes.
• Signal Bar Disappearance: Users observed the immediate disappearance of signal bars on the affected phones, indicating a complete loss of cellular connectivity due to the baseband's failure.

This direct, over-the-air validation unequivocally demonstrated that the vulnerabilities discovered by Loris were not merely theoretical but were practically exploitable in real-world scenarios. The immediate crashes confirmed a denial-of-service (DoS) impact, preventing the affected devices from communicating over the cellular network. Furthermore, the nature of memory corruption vulnerabilities means that with additional exploit development (chaining them with other techniques), these flaws could potentially be escalated to achieve more severe consequences, such as remote code execution (RCE) on the baseband or even exfiltration of sensitive data from the device. The inclusion of a vulnerability triggered by a malicious SMS further underscored the diverse and practical attack vectors that Loris can identify.

Defensive Implications

▶ Watch: Performance evaluation and coverage comparison (8:00)

The findings presented by Loris carry significant implications for both baseband manufacturers and the broader cybersecurity community. Addressing these vulnerabilities requires a multi-faceted approach, encompassing secure development practices, enhanced testing methodologies, and improved monitoring.

1. Vendor Patching and Secure Development: The most immediate defensive action is for baseband vendors to promptly patch the CVEs identified by Loris. Beyond reactive patching, there's a critical need to re-evaluate and enhance secure coding guidelines. The prevalence of memory-unsafe languages like C and C++ in baseband development is a root cause of many vulnerabilities. While a complete shift to memory-safe languages might be impractical in the short term due robust codebases, vendors should aggressively adopt and enforce memory safety mitigations (e.g., ASLR, DEP, CFI where applicable) and invest in static analysis tools that can detect common memory errors during the development cycle.

1. Integration of Advanced Stateful Fuzzing: The success of Loris highlights the inadequacy of traditional fuzzing and analysis techniques for deeply stateful systems. Baseband developers and security teams should integrate advanced, state-aware fuzzing frameworks like Loris into their continuous integration/continuous delivery (CI/CD) pipelines. This proactive approach can identify complex, state-dependent bugs early in the development lifecycle, significantly reducing the cost and risk associated with post-release vulnerabilities. The grammar-aware fuzzer component of Loris, which automatically generates valid protocol messages, is particularly valuable in this context.

1. Enhanced Runtime Monitoring: Device manufacturers and mobile network operators should explore enhanced runtime monitoring capabilities for baseband behavior. Detecting unusual activity, such as unexpected crashes, reboots, or abnormal resource consumption within the baseband, could serve as an early warning system for attempted exploitation or successful compromises. While challenging due to the real-time and isolated nature of basebands, improved logging and anomaly detection could provide crucial forensic data.

1. Network-Level Defenses: Although baseband vulnerabilities are typically exploited through over-the-air messages, core network infrastructure could potentially play a role in mitigating some threats. More stringent validation and sanity checks on incoming cellular messages, where feasible, might help filter out malformed or overtly malicious packets before they reach the end device's baseband. However, this is a complex area, as basebands are designed to be highly resilient to network anomalies and protocol variations.

1. Supply Chain Security: The research underscores the importance of rigorous security vetting throughout the mobile device supply chain. As basebands are often third-party components, device manufacturers must demand and verify robust security assurances from their baseband vendors, including evidence of comprehensive security testing and vulnerability disclosure programs.

In essence, Loris provides a powerful new lens through which to view baseband security, urging the industry to move beyond superficial analysis and embrace methodologies capable of unraveling the intricate statefulness that defines these critical communication processors.

Key Takeaways

• Baseband Firmware is a Critical, Vulnerable Attack Surface: Basebands are dedicated processors handling all cellular communication, developed in memory-unsafe languages (C/C++), and are highly susceptible to remote exploitation via malicious over-the-air messages, potentially leading to denial of service or remote code execution.
• Statefulness is the Primary Challenge for Analysis: The deeply stateful and interdependent nature of baseband tasks, with numerous internal state variables and complex preconditions, causes traditional symbolic execution to suffer from "path explosion" and hinders existing dynamic analysis tools.
• Loris's Iterative Symbolic Analysis Solves Statefulness: The framework introduces an innovative iterative symbolic analysis that progressively uncovers necessary state variables and their preconditions, enabling deep code exploration and effective mitigation of path explosion.
• Real-World Exploits Discovered and Validated: Loris successfully identified seven new, exploitable vulnerabilities (integer, heap, and stack overflows) in commercial baseband firmware, confirmed by vendors with assigned CVEs (some high/critical severity), and validated through over-the-air exploitation on real devices.
• Superior Coverage and Automation: Loris consistently outperforms prior dynamic analysis tools in basic block coverage, even without manual harnessing, and features a grammar-aware fuzzer that automatically generates valid NAS messages, eliminating the need for manual seeds or complex setup.
• Urgent Call for Enhanced Security Practices: The research highlights the critical need for baseband manufacturers to adopt advanced stateful fuzzing in their development cycles, enhance memory safety mitigations, and improve monitoring to better protect these vital components from sophisticated attacks.

About the Speaker(s)

The research presented on Stateful Analysis and Fuzzing of Commercial Baseband Firmware was a collaborative effort by a team of distinguished researchers from Pennsylvania State University.

Ali Ranjbar served as the primary speaker for this presentation. His work, as demonstrated by Loris, focuses on cutting-edge techniques for uncovering deep security vulnerabilities in complex embedded systems, particularly within the critical domain of baseband firmware. His expertise lies in developing novel analysis and fuzzing frameworks that can overcome the significant challenges posed by statefulness and intricate protocol logic.

The co-authors, Tianchang Yang, Kai Tu, Saaman Khalilollahi, and Syed Rafiul Hussain, are also affiliated with Pennsylvania State. Their collective research interests likely encompass various aspects of systems security, mobile security, vulnerability research, and the development of advanced program analysis techniques. Their contributions were instrumental in the design, implementation, and validation of the Loris framework, furthering the state of the art in securing crucial components of modern communication technology.