D-Fault: Uncovering Disaggregation Faults in 5G RAN

摘要

The disaggregation of the 5G Radio Access Network (RAN) decomposes traditional base stations into distributed components such as the centralized unit (CU) and distributed unit (DU). While this architecture improves flexibility and vendor interoperability, it also turns many control procedures into distributed workflows executed by independent state machines. We show that such executions can lead to Disaggregation Faults (DF), where specification-compliant procedure interactions drive different RAN components into inconsistent control-plane states. We present D-Fault, a testing framework that systematically uncovers DF bugs by generating adversarial interleavings of control procedures and initiating them with targeted timing. A model-guided exploration reduces the intractable search space, while verification based on externally observable behavior detects inconsistencies without access to internal states. We implement D-Fault and evaluate it on SDR-based testbeds, uncovering 17 unique DF bugs that lead to serious effects such as resource corruption and denial of service.