Towards Operator-Empowered Vulnerability Hotfixing for 5G Radio Access Networks
2026-08-31 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors introduce Buckler, a system that helps mobile network operators quickly fix security problems in their wireless networks without waiting for long official updates. Buckler works by adding small checkpoints in the radio access network to detect and block attacks using simple rules. The team tested Buckler on real network software and showed it could prevent many known attacks using just a few standard checks. They also found some attacks that Buckler cannot stop because they depend on things outside the network. Overall, the authors show that Buckler offers a practical way for operators to protect users while permanent fixes are being developed.
radio access networkcellular protocolhotfixL2/L3 channelsmatch-action interfacenetwork operatorsrsRANOpenAirInterfaceavailability attackprivacy attack
Authors
Dong Hyeok Kim, Xin Zhe Khooi, Hocheol Nam, Seungjin Baek, Mun Choon Chan, CheolJun Park, Min Suk Kang
Abstract
Cellular protocol vulnerabilities can remain exploitable for months or years while standards bodies, vendors, and mobile network operators (MNOs) coordinate permanent fixes. We present Buckler, a framework that enables an MNO to deploy temporary, local, and reversible hotfixes in its radio access network (RAN) during this exposure window. Buckler places reusable hooks at standardized L2/L3 channel boundaries and exposes a closed, stateful match-action interface with three preventive actions: DROP, MODIFY, and RELEASE. We evaluate whether this bounded design provides useful coverage without requiring extensive changes to existing RANs. From 23 papers, we identify 64 attacks rooted in standard L2/L3 protocol behavior, of which 43 provide a preventive intervention point at the RAN, and we construct Buckler hotfixes for 20 of them. All 20 hotfixes use the same rule vocabulary and only five standardized channel hooks, while the unsupported attacks expose endpoint dependencies that a RAN cannot satisfy alone. We implement the five hooks on srsRAN and OpenAirInterface with small, structurally similar changes, and demonstrate all three actions against representative availability and privacy attacks. These results establish operator-empowered hotfixing as a practical and portable interim defense and delineate the architectural limits of RAN-only prevention.