August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in libsmpp34[master]: smpp34_unpack: bound C_OCTET scan with strnlen()
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email ) Change subject: smpp34_unpack: bound C_OCTET scan with strnlen() ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libsmpp34 Gerrit-Branch: master Gerrit-Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 Gerrit-Change-Number: 42889 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Mon, 10 Aug 2026 06:25:27 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-iuh[master]: iu_client: reject oversized RANAP NAS-PDU
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email ) Change subject: iu_client: reject oversized RANAP NAS-PDU ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I7dbce926477f9842cd466d46cda836638f04011f Gerrit-Change-Number: 42887 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Mon, 10 Aug 2026 06:24:34 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libasn1c[master]: constr_CHOICE: fix always-true bounds check
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email ) Change subject: constr_CHOICE: fix always-true bounds check ...................................................................... Patch Set 3: Code-Review+1 (1 comment) Patchset: PS3: this must first and foremost be fixed in upstream asn1c, if it hasn't yet, as libasn1c is merely a shared library version of the asn1c runtime. -- To view, visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libasn1c Gerrit-Branch: master Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf Gerrit-Change-Number: 42890 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Mon, 10 Aug 2026 06:23:02 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by laforge 10 Aug '26

10 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... ipaccess-proxy: reject oversized IPA frame length ipaccess_proxy_read_msg() reads the 16-bit IPA frame length from the wire header and passes it straight as the recv() count into a msgb that was allocated with a fixed PROXY_ALLOC_SIZE (1200) bytes, without ever checking it against the buffer tailroom. A peer that advertises a body length larger than the remaining buffer space makes recv() write past the end of the heap allocation (heap buffer overflow). Reject frames whose advertised length exceeds the msgb tailroom, the same way the other IPA read paths bound the read to msgb_tailroom(). This issue has been assigned the CVE candidate identifier CAN-2026-2051036. Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 6 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved fixeria: Looks good to me, but someone else must approve diff --git a/src/ipaccess/ipaccess-proxy.c b/src/ipaccess/ipaccess-proxy.c index 61c2fc2..71190f6 100644 --- a/src/ipaccess/ipaccess-proxy.c +++ b/src/ipaccess/ipaccess-proxy.c @@ -583,6 +583,12 @@ /* then read the length as specified in header */ msg->l2h = msg->data + sizeof(*hh); len = ntohs(hh->len); + if (len > msgb_tailroom(msg)) { + LOGP(DLINP, LOGL_ERROR, "Oversized IPA frame: len %d > tailroom %d\n", len, msgb_tailroom(msg)); + msgb_free(msg); + *error = -EIO; + return NULL; + } ret = recv(bfd->fd, msg->l2h, len, 0); if (ret < len) { LOGP(DLINP, LOGL_ERROR, "short read!\n"); -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 5 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject short IPA header
by laforge 10 Aug '26

10 Aug '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email ) Change subject: ipaccess-proxy: reject short IPA header ...................................................................... ipaccess-proxy: reject short IPA header recv() of the 3-byte IPA header can return fewer than 3 bytes on a stream socket. ipaccess_proxy_read_msg() only handles ret < 0 and ret == 0, so a short read falls through: msgb_put() advances msg->tail by 'ret' while msg->l2h is set to msg->data + sizeof(*hh). The frame length is then validated against msgb_tailroom() (measured from msg->tail), so the subsequent body recv() into msg->l2h can write up to sizeof(*hh) - ret bytes past the msgb. Reject a short header, the same way handle_udp_read() already does. Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 10 insertions(+), 0 deletions(-) Approvals: fixeria: Looks good to me, but someone else must approve Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/src/ipaccess/ipaccess-proxy.c b/src/ipaccess/ipaccess-proxy.c index 71190f6..b1c500c 100644 --- a/src/ipaccess/ipaccess-proxy.c +++ b/src/ipaccess/ipaccess-proxy.c @@ -576,6 +576,16 @@ msgb_free(msg); *error = ret; return NULL; + } else if (ret < sizeof(*hh)) { + /* A short (split) IPA header would leave msg->l2h (msg->data + + * sizeof(*hh)) ahead of msg->tail, while the frame length below is + * validated against msgb_tailroom() measured from msg->tail; the + * body recv() could then write up to sizeof(*hh) - ret bytes past + * the buffer. Reject it, like the other IPA read paths do. */ + LOGP(DLINP, LOGL_ERROR, "short read of IPA header (%d)\n", ret); + msgb_free(msg); + *error = -EIO; + return NULL; } msgb_put(msg, ret); -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b Gerrit-Change-Number: 43188 Gerrit-PatchSet: 2 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject short IPA header
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email ) Change subject: ipaccess-proxy: reject short IPA header ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b Gerrit-Change-Number: 43188 Gerrit-PatchSet: 2 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Mon, 10 Aug 2026 06:22:01 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... Patch Set 5: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 5 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Mon, 10 Aug 2026 06:21:25 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject short IPA header
by fixeria 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email ) Change subject: ipaccess-proxy: reject short IPA header ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b Gerrit-Change-Number: 43188 Gerrit-PatchSet: 2 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Sun, 09 Aug 2026 15:21:38 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by fixeria 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... Patch Set 5: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 5 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Sun, 09 Aug 2026 15:20:33 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ggsn[master]: gtp: clamp GSN-Address copy to sockaddr_in size
by lynxis lazus 09 Aug '26

09 Aug '26

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email ) Change subject: gtp: clamp GSN-Address copy to sockaddr_in size ...................................................................... gtp: clamp GSN-Address copy to sockaddr_in size gtp_data_req() builds an IPv4 destination sockaddr_in and does memcpy(&addr.sin_addr, pdp->gsnru.v, pdp->gsnru.l); gtp_gpdu_ind() checks the GPDU source with memcmp(&peer->sin_addr, pdp->gsnru.v, pdp->gsnru.l). Both use the wire GSN-Address length as the count into the 4-byte sin_addr, so a GSN-Address longer than 4 bytes (e.g. a 16-byte IPv6 address) writes up to 4 bytes past the sockaddr_in on the stack, or reads up to 12 bytes past sin_addr. Both sites already carried a 'TODO range check' comment. This is the AF_INET user-plane path, where the GSN address is a 4-byte IPv4 address, so copy and compare exactly sizeof(sin_addr) bytes. Change-Id: If49f1929645c0ba8d19f3c9aa95f57d0a432ad53 --- M gtp/gtp.c 1 file changed, 8 insertions(+), 2 deletions(-) Approvals: pespin: Looks good to me, but someone else must approve lynxis lazus: Looks good to me, approved Jenkins Builder: Verified diff --git a/gtp/gtp.c b/gtp/gtp.c index fa65575..7a439d9 100644 --- a/gtp/gtp.c +++ b/gtp/gtp.c @@ -3280,7 +3280,10 @@ } /* If the GPDU was not from the peer GSN tell him to delete context */ - if (memcmp(&peer->sin_addr, pdp->gsnru.v, pdp->gsnru.l)) { /* TODO Range? */ + /* Compare only the IPv4 address bytes; peer->sin_addr is 4 bytes, so + * bound the compare to sizeof(sin_addr) rather than the (attacker-influenced) + * gsnru length to avoid reading past sin_addr. */ + if (memcmp(&peer->sin_addr, pdp->gsnru.v, sizeof(peer->sin_addr))) { rate_ctr_inc2(gsn->ctrg, GSN_CTR_ERR_UNKNOWN_PDP); GTP_LOGPKG(LOGL_ERROR, peer, pack, len, "Unknown GSN peer %s\n", inet_ntoa(peer->sin_addr)); return gtp_error_ind_resp(gsn, version, peer, fd, pack, len); @@ -3778,7 +3781,10 @@ #if defined(__FreeBSD__) || defined(__APPLE__) addr.sin_len = sizeof(addr); #endif - memcpy(&addr.sin_addr, pdp->gsnru.v, pdp->gsnru.l); /* TODO range check */ + /* gsnru is the IPv4 GSN user-plane address for this AF_INET path; copy + * exactly sizeof(sin_addr) bytes so an over-long (e.g. 16-byte IPv6) + * address cannot write past addr on the stack. */ + memcpy(&addr.sin_addr, pdp->gsnru.v, sizeof(addr.sin_addr)); /* prepare msghdr */ memset(&msgh, 0, sizeof(msgh)); -- To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ggsn Gerrit-Branch: master Gerrit-Change-Id: If49f1929645c0ba8d19f3c9aa95f57d0a432ad53 Gerrit-Change-Number: 43187 Gerrit-PatchSet: 1 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026