LLFuzz: An Over-the-Air Dynamic Testing Framework for Cellular Baseband...
summary
LLFuzz is an over-the-air dynamic tester that targets PDCP, RLC, MAC and PHY lower layers by generating 3GPP-spec-compliant test cases and actively toggling layer configurations via signaling to reach rarely used packet formats. It runs against real devices using a full-stack base station, monitors crashes with ADB log-based crash detection and vendor debug-mode replay, and implements channel-driven, configuration-aware fuzzing in ~11k lines of C/C++. Evaluated on 15 commercial basebands from five vendors, it uncovers nine previously unknown memory corruptions (2 PDCP, 2 RLC, 5 MAC).
AI-written summary · about
chapters (15)
- 0:00LLFuzz research introduction
- 1:17Baseband vulnerabilities risks
- 2:43Prior testing limitations
- 3:24Testing lower cellular layers
- 5:09Test case generation
- 5:52Channel-driven testing
- 6:57Configuration-aware testing
- 7:39LLFuzz system design
- 8:41Test case generation process
- 9:23Crash detection analysis
- 10:49Results on 15 basebands
- 11:33Supply chain patching challenges
- 12:16Extending LLFuzz to 5G
- 12:575G testing challenges
- 13:18Conclusion future research
related talks
39mFuzzing GPRS Layer-2 For Fun And Profit
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
32mFuzzing Zephyr Apps - Struggles of Dynamic Analysis on Embedded Applications
32mBluetooth Low Energy GATT Fuzzing: Specification To Implementation
20mD2T2 - A New Fuzzing Method for Android
53mFuzz Testing for Fun and Profit
31m“Fuzz or lose..."
13mTCP-Fuzz: Detecting Memory and Semantic Bugs in TCP Stacks with Fuzzing