Description

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-23T09:17:08.727Z",
  "pubdate": "2026-09-23T09:17:08.727Z",
  "executiveSummary": "A NULL pointer dereference vulnerability has been identified within the as_rrc module of ASR Crane and Falcon Linux-based firmware. This defect involves improper pointer validation, which can be manipulated to trigger a system-level fault.\nThe vulnerability resides specifically within the file path 3g.mod/lib/src/urrsir.c, which handles core radio resource signaling. If successfully exploited, this flaw leads to a kernel panic or an immediate crash of the affected communication stack, resulting in a denial-of-service (DoS) condition.\nThe vulnerability allows an attacker to leverage pointer manipulation techniques to induce invalid memory access. Given the role of the as_rrc module in handling network signaling, the risk implications include the disruption of cellular connectivity and potential instability of the baseband processor.\nExploitation requires the ability to influence input vectors processed by the urrsir.c component. Depending on the system architecture and memory protections, there may be potential for memory corruption if the dereferenced NULL pointer address is mapped or controllable by the attacker, though the primary impact remains service degradation.",
  "technicalDetails": "The vulnerability originates in the urrsir.c source file within the 3g.mod/lib/src/ directory, specifically within the logic governing the Radio Resource Control (RRC) signaling plane. The root cause is a failure to verify that a pointer used for memory referencing is non-NULL prior to performing an access operation.\nIn the context of the as_rrc module, pointers are initialized to NULL and are expected to be populated by the resource allocation routines before being accessed. If the execution flow reaches a code path where this initialization is bypassed—or if an error condition prevents the allocation but the subsequent logic proceeds regardless—a NULL pointer is dereferenced.\nThe attack flow typically involves an attacker crafting specific Radio Resource Signaling packets that force the as_rrc module into an error state or an unexpected control flow branch. By sending malformed messages that bypass the expected state machine, an attacker triggers the invocation of the vulnerable function in urrsir.c.\nOnce the vulnerable function executes, the CPU attempts to dereference the NULL pointer (address 0x0). On Linux kernel-based systems, this access generally triggers a segmentation fault or a kernel oops, resulting in an immediate system halt. Because this occurs within the driver or baseband module, the entire communication stack often fails, causing the device to lose network synchronization.\nExploitation requires the attacker to have the capability to interact with the device’s radio interface or process-level hooks that feed data into the 3g.mod module. The privilege requirements depend on the exposure of the signaling interface; however, since this is a low-level module, it is typically handled in a high-privilege execution environment.\nPost-exploitation impact is primarily limited to a Denial-of-Service (DoS) caused by the kernel/driver crash. However, in specific hardware implementations where the zero-page is writable or can be mapped by a user-space process (though rare in modern hardened Linux kernels), there exists theoretical potential for controlled pointer manipulation to redirect execution flow, though the current manifestation is characterized by immediate system termination due to memory access violations."
}