The Compiler That Can't Read - Crashing Every 5G Phone With 1 Byte

The talk looks at the baseband modem in a 5G phone, a separate processor that handles radio messages from cell towers. The speakers focus on the window before the phone authenticates to a network, when a rogue base station can send a crafted radio setup message that the modem decodes and acts on, with no user interaction.

The core argument is that code generated from ASN.1 schemas only enforces what the schema expresses. Presence conditions and cross-field dependencies that exist only in 3GPP specification prose are lost, so a structurally valid message can break the standard. Some implementations also accept integer values above the allowed maximum because the encoding has spare bit patterns. The researchers describe a pipeline that extracts these rules from the specification, uses a language model to turn them into testable constraints, and mutates valid messages to violate them. They report crashes in basebands from several chipset vendors and show a live over-the-air demonstration.

For defenders, the practical lesson is to validate decoded values before the baseband uses them, not to trust the decoder alone. The speakers also argue that machine-readable rules in the standards would let tooling enforce them. The same gap may appear in other ASN.1-based systems, including LTE and some automotive and aviation protocols.