Ella Core panics on malformed ULNASTransport Message without a Request Type

Vulnerability

Description

Ella Core, a 5G core designed for private networks, contains a denial-of-service vulnerability in versions prior to 1.6.0. The software panics when processing a malformed UL NAS Transport NAS message that lacks a Request Type field. This occurs because the code does not validate the presence of the Request Type before attempting to handle the message, leading to a panic and process crash [1][3].

Attack

Vector and Exploitation

An attacker can exploit this vulnerability by sending a crafted NAS message over the network to the Ella Core instance. No authentication is required, and the attack can be performed remotely with low complexity. The vulnerability is triggered solely by the malformed message, without requiring any user interaction or special privileges [3].

Impact

Successful exploitation causes the Ella Core process to crash, resulting in a complete denial of service for all connected subscribers. Since the crash disrupts the core network functions, all subscriber sessions are terminated and service is unavailable until the process is restarted. There is no impact on confidentiality or integrity [1][3].

Mitigation

The vulnerability is fixed in Ella Core version 1.6.0, which adds a guard to check for the presence of a Request Type when receiving an UL NAS Message without an SM Context. Users should upgrade to version 1.6.0 or later. No workarounds are available [1][3].