OSV 1.4.0 · github-reviewed · 修改于 2026-06-09 07:48
发布时间
2026-05-11 23:29
GitHub 审查时间
2026-05-11 23:29
NVD 发布时间
2026-05-28 01:16
源文件
advisories/github-reviewed/2026/05/GHSA-mc29-hmx6-856q/GHSA-mc29-hmx6-856q.json
Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa).
Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger.
Ella Core now enforces both rules from §6.9.5.1, blocking concurrent Security Mode Command and N2 handover procedures.