Towards Operator-Empowered Vulnerability Hotfixing for 5G Radio Access Networks

2026-08-31

AI Summary

本文提出Buckler框架，通过在5G无线接入网中部署临时、局部且可逆的热修复措施来解决蜂窝协议漏洞长期暴露的问题。

Abstract

Cellular protocol vulnerabilities can remain exploitable for months or years while standards bodies, vendors, and mobile network operators (MNOs) coordinate permanent fixes. We present Buckler, a framework that enables an MNO to deploy temporary, local, and reversible hotfixes in its radio access network (RAN) during this exposure window. Buckler places reusable hooks at standardized L2/L3 channel boundaries and exposes a closed, stateful match-action interface with three preventive actions: DROP, MODIFY, and RELEASE. We evaluate whether this bounded design provides useful coverage without requiring extensive changes to existing RANs. From 23 papers, we identify 64 attacks rooted in standard L2/L3 protocol behavior, of which 43 provide a preventive intervention point at the RAN, and we construct Buckler hotfixes for 20 of them. All 20 hotfixes use the same rule vocabulary and only five standardized channel hooks, while the unsupported attacks expose endpoint dependencies that a RAN cannot satisfy alone. We implement the five hooks on srsRAN and OpenAirInterface with small, structurally similar changes, and demonstrate all three actions against representative availability and privacy attacks. These results establish operator-empowered hotfixing as a practical and portable interim defense and delineate the architectural limits of RAN-only prevention.

Problem

• 5G Radio Access Networks
• Vulnerability Hotfixing
• Mobile Network Operators
• Protocol Vulnerabilities
• Exposure Window

Innovation

• Operator-Empowered Hotfixing
• Radio Access Network (RAN)
• Temporary and Reversible Patches
• Standardized L2/L3 Boundaries
• Stateful Match-Action Interface