The 5Ghoul attacks range from temporary service disruptions to network downgrades, which may be more severe from a security standpoint.
The researchers discovered the flaws while experimenting with 5G modem firmware analysis and report that the flaws are easy to exploit over-the-air by impersonating a legitimate 5G base station.
This applies even when attackers lack information about the target's SIM card, as the attack occurs before the NAS authentication step.
Attackers can send an invalid downlink MAC frame to the target 5G UE from a nearby malicious gNB, leading to a temporary hang and modem reboot.
This vulnerability allows attackers to send an invalid NAS PDU to the target UE, resulting in modem failure and reboot.
CVE-2023-33042: Disabling 5G/Downgrade via Invalid RRC pdcch-Config in Qualcomm X55/X60 modems, leading to either downgrade or denial of service.
An attacker can send a malformed RRC frame during the RRC Attach Procedure, disabling 5G connectivity and requiring a manual reboot for restoration.
The vulnerability involves sending a malformed RRC Connection Setup, leading to modem failure and reboot in affected devices.
Attackers can send a malformed RRC Connection Setup, causing the modem to fail and reboot.
An attacker can exploit this by sending a malformed RLC Status PDU, leading to a modem crash and reboot.
Malformed RRC Connection Setup can cause memory access errors, leading to a modem crash.
This involves sending a malformed RRC Connection Setup, causing a modem crash in affected devices.
Sending a malformed RRC Connection Setup can result in modem failure and reboot in affected devices.
Malformed RRC Connection Setup can trigger a modem crash by setting certain RRC payload fields to null.
CVE-2023-33042 is particularly concerning because it can force a device to disconnect from a 5G network and fall back to 4G, exposing it to potential vulnerabilities in the 4G domain that expose it to a broader range of attacks.
The DoS flaws in these vulnerabilities cause the devices to lose all connectivity until they are rebooted.
To learn more about the 5Ghoul flaws, their exploitation potential and ramifications, and technical information can be found in the researchers' whitepaper.
Both Qualcomm and MediaTek released security bulletins on Monday for the disclosed 5Ghoul vulnerabilities,.
Signs of a 5Ghoul attack include loss of 5G connections, inability to re-connect until the device is rebooted, and consistent drop to 4G despite the availability of a 5G network in the area.
WordPress fixes POP chain exposing websites to RCE attacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 08 Dec 2023 15:25:11 +0000