Ella Core panics on malformed NGAP Location Report

Vulnerability

Details

Ella Core, a 5G core for private networks, panics when processing a malformed NGAP LocationReport message with event type ue-presence-in-area-of-interest and omitting the optional UEPresenceInAreaOfInterestList information element. The panic occurs due to insufficient verification of mandatory IEs, leading to a nil pointer dereference or similar crash condition [1][3].

Exploitation

An attacker can exploit this by sending a crafted NGAP message to the Ella Core process. No authentication is required, and the attacker does not need prior access to the network other than the ability to send NGAP messages on the N2 interface. This makes the vulnerability remotely exploitable from within the 5G network [1][3].

Impact

Successful exploitation crashes the Ella Core process, causing a denial of service for all connected subscribers. Since the core handles all signaling, the outage affects the entire private network, disrupting communication and data services [1][3].

Mitigation

The vulnerability is fixed in Ella Core version 1.6.0, which adds proper IE presence verification to NGAP message handling. Users should upgrade to 1.6.0 or later. No workarounds are documented [1][3].