A radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection, then creates a GTP tunnel towards that radio.
Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa).
Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest.
Ella Core panics when processing a NGAP handover failure message.
The PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI.
Ella Core panics when processing a specially crafted NGAP LocationReport message.
Ella Core panics when processing Authentication Response and Authentication Failure NAS message missing IEs.
The NetworkManager role was granted backup and restore permission. The restore endpoint accepted any valid SQLite file without verifying its contents.
A deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted.
Ella Core panics when processing malformed UL NAS Transport NAS messages without a Request Type.
Ella Core panics when processing a malformed NGAP LocationReport message with ue-presence-in-area-of-interest event type and omitting the optional UEPresenceInAreaOfInterestList IE.
Ella Core panics when processing NGAP messages with invalid PDU Session IDs outside of 1-15.
Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity protection algorithm bitstrings, resulting in a denial of service.
Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a length under 7 bytes.