August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in osmo-ttcn3-hacks[master]: SGP32Definitions_Templates: fix template tr_smdpSigned2
by dexter 07 Aug '26

07 Aug '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43180?usp=email ) Change subject: SGP32Definitions_Templates: fix template tr_smdpSigned2 ...................................................................... SGP32Definitions_Templates: fix template tr_smdpSigned2 The member bppEuiccOtpk is currently expected to be always present with any value (?), which is not correct since it is an optional parameter (*). Change-Id: I660838e47334a9dc9eb12b967e7f92b465e86eb2 Related: SYS#8100 --- M library/euicc/RSPDefinitions_Templates.ttcn 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/80/43180/1 diff --git a/library/euicc/RSPDefinitions_Templates.ttcn b/library/euicc/RSPDefinitions_Templates.ttcn index 8c3886e..b7ea50c 100644 --- a/library/euicc/RSPDefinitions_Templates.ttcn +++ b/library/euicc/RSPDefinitions_Templates.ttcn @@ -200,7 +200,7 @@ template (present) boolean ccRequiredFlag := ?) := { transactionId := transactionId, ccRequiredFlag := ccRequiredFlag, - bppEuiccOtpk := ? + bppEuiccOtpk := * } template (value) SmdpSigned2 ts_smdpSigned2(template (value) octetstring transactionId := 'ABCDEF'O, template (value) boolean ccRequiredFlag := false) := { -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43180?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I660838e47334a9dc9eb12b967e7f92b465e86eb2 Gerrit-Change-Number: 43180 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[M] Change in osmo-ttcn3-hacks[master]: eim_Tests: Add testcase to test ESipa/ES9+: CancelSession
by dexter 07 Aug '26

07 Aug '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43182?usp=email ) Change subject: eim_Tests: Add testcase to test ESipa/ES9+: CancelSession ...................................................................... eim_Tests: Add testcase to test ESipa/ES9+: CancelSession The testsuite never sends or receives any messages related to ESipa/ES9+ CancelSession, let's implement a varinat of the "Cancel Session Procedure for Indirect Profile Download" as described in SGP.32 section 3.2.3.3 to increase the coverage accordingly. Related: SYS#8100 Change-Id: Iadc9010fcf08de98f7d8c2a5c68bb5ff71bfb1f6 --- M eim/eIM_Tests.ttcn 1 file changed, 59 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/82/43182/1 diff --git a/eim/eIM_Tests.ttcn b/eim/eIM_Tests.ttcn index f55af29..adf5411 100644 --- a/eim/eIM_Tests.ttcn +++ b/eim/eIM_Tests.ttcn @@ -580,6 +580,64 @@ setverdict(pass); } +/* A testcase to try out an unsuccessful indirect profile download where the session gets canceled + * See also: GSMA SGP.32, section 3.2.3.3: Cancel Session Procedure for Indirect Profile Download */ +private function f_TC_proc_indirect_prfle_dwnld_cancel_session(charstring id) runs on eIM_ConnHdlr { + var charstring resource_id; + var HTTP_Adapter_Params http_adapter_pars; + var charstring smdpp_add := mp_es9p_ip & ":" & int2str(mp_es9p_port) + var charstring activationCode := "1$" & smdpp_add & "$MyMatchingId" + var template EsipaMessageFromEimToIpa esipa_res; + var octetstring eimTransactionId; + + f_http_register(); + + f_init_pipe(); + http_adapter_pars := { + http_host := mp_esipa_ip, + http_port := mp_esipa_port, + use_ssl := not mp_esipa_disable_ssl + }; + f_http_init(http_adapter_pars); + + /* Create a new download at the eIM */ + resource_id := f_rest_create_order("download", ts_JSON_REST_download_order(eID, activationCode)); + + /* Check the eIM for new eIM packages, we expect to get a profileDownloadTriggerRequest that contains the + * activationCode that we have created the download with (see above) */ + esipa_res := f_esipa_transceive(valueof(ts_getEimPackageRequest(eID)), + tr_getEimPackageResponse_dnlTrigReq(tr_profileDownloadTriggerRequest(activationCode))); + eimTransactionId := valueof(esipa_res.getEimPackageResponse.profileDownloadTriggerRequest.eimTransactionId); + + /* Perform common mutial authentication procedure */ + f_proc_cmn_mtl_auth(eimTransactionId); + + /* Request/download bound profile package */ + f_esipa_send(valueof(ts_getBoundProfilePackageRequestEsipa)); + f_es9p_transceive(valueof(ts_getBoundProfilePackageResponse), tr_getBoundProfilePackageRequest); + f_esipa_receive(tr_getBoundProfilePackageResponseEsipa); + + /* Cancel session */ + f_esipa_send(valueof(ts_cancelSessionRequestEsipa)); + f_es9p_transceive_empty_response(tr_cancelSessionRequestEs9); + + f_rest_lookup_resource(resource_id, "download", tr_JSON_REST_success); + f_rest_delete_resource(resource_id, "download"); + + f_sleep(2.0); + setverdict(pass); +} +testcase TC_proc_indirect_prfle_dwnld_cancel_session() runs on MTC_CT { + var charstring id := testcasename(); + var eIM_ConnHdlrPars pars := f_init_pars(); + var eIM_ConnHdlr vc_conn; + f_init(id); + vc_conn := f_start_handler(refers(f_TC_proc_indirect_prfle_dwnld_cancel_session), pars); + vc_conn.done; + setverdict(pass); +} + + /* A testcase to try out an the Generic eUICC Package Download and Execution Procedure (PSMO), * See also: GSMA SGP.32, section 3.3.1: Generic eUICC Package Download and Execution */ private function f_TC_proc_euicc_pkg_dwnld_exec_psmo_or_eco(charstring facility, charstring id, @@ -1008,6 +1066,7 @@ control { execute ( TC_proc_indirect_prfle_dwnld() ); + execute ( TC_proc_indirect_prfle_dwnld_cancel_session() ); execute ( TC_proc_euicc_pkg_dwnld_exec_enable_psmo() ); execute ( TC_proc_euicc_pkg_dwnld_exec_disable_psmo() ); execute ( TC_proc_euicc_pkg_dwnld_exec_delete_psmo() ); -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43182?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Iadc9010fcf08de98f7d8c2a5c68bb5ff71bfb1f6 Gerrit-Change-Number: 43182 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in osmo-ttcn3-hacks[master]: eIM: add testcase to test an unsuccessful eUICC data request
by dexter 07 Aug '26

07 Aug '26

Attention is currently required from: jolly, laforge. Hello Jenkins Builder, jolly, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42955?usp=email to look at the new patch set (#9). The following approvals got outdated and were removed: Code-Review+1 by jolly, Code-Review+1 by laforge, Verified+1 by Jenkins Builder Change subject: eIM: add testcase to test an unsuccessful eUICC data request ...................................................................... eIM: add testcase to test an unsuccessful eUICC data request When we test the ipaEuiccDataRequest/IpaEuiccDataResponse, we currently only test the success case. However, we should also test the failure case, bceause an IpaEuiccDataResponseError can also contain an eimTransactionId, which has to be equal to the eimTransactionId we have received with the ipaEuiccDataRequest Related: SYS#8100 Change-Id: Ied212eb636cf46df5fc9f86ddee15c242c50d45a --- M eim/eIM_Tests.ttcn 1 file changed, 46 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/55/42955/9 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42955?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ied212eb636cf46df5fc9f86ddee15c242c50d45a Gerrit-Change-Number: 42955 Gerrit-PatchSet: 9 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in osmo-ttcn3-hacks[master]: SGP32Definitions: remove wrong comment about workaround
by dexter 07 Aug '26

07 Aug '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43179?usp=email ) Change subject: SGP32Definitions: remove wrong comment about workaround ...................................................................... SGP32Definitions: remove wrong comment about workaround This patch removes a misplaced workaround comment. The ASN.1 structures in questions are equal to the original spec and were not modified. Related: SYS#8100 Change-Id: Id54ba6a1541c8d667e0381239fa850175609ab85 --- M library/euicc/SGP32Definitions.asn 1 file changed, 0 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/79/43179/1 diff --git a/library/euicc/SGP32Definitions.asn b/library/euicc/SGP32Definitions.asn index 93b31b2..dcfe1c5 100644 --- a/library/euicc/SGP32Definitions.asn +++ b/library/euicc/SGP32Definitions.asn @@ -608,11 +608,9 @@ parametersNotAvailable(1), undefinedError(127) } --- workaround for erlang asn1ct: remove already specified context-specific tag SGP32-SetDefaultDpAddressRequest ::= [101] SEQUENCE { -- Tag 'BF65' defaultDpAddress UTF8String -- Default SM-DP+ address as an FQDN } --- workaround for erlang asn1ct: remove already specified context-specific tag SGP32-SetDefaultDpAddressResponse ::= [101] SEQUENCE { -- Tag 'BF65' setDefaultDpAddressResult INTEGER { ok (0), undefinedError (127)} } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43179?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Id54ba6a1541c8d667e0381239fa850175609ab85 Gerrit-Change-Number: 43179 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in osmo-ttcn3-hacks[master]: eim/testenv: re-align path to restop.py
by dexter 07 Aug '26

07 Aug '26

Attention is currently required from: dexter. Hello Jenkins Builder, jolly, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43147?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder The change is no longer submittable: Verified is unsatisfied now. Change subject: eim/testenv: re-align path to restop.py ...................................................................... eim/testenv: re-align path to restop.py The location of restop.py in the onomondo-eim git repository has changed. This patch re-alignes the path. Related: SYS#8100 Depends: onomondo-eim.git I4e42ce85c84b47d3561011083da4a1e54958fd8e Change-Id: I23b3085b4af8ed51c24f4b50385617e81f17a434 --- M eim/testenv.cfg 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/47/43147/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43147?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I23b3085b4af8ed51c24f4b50385617e81f17a434 Gerrit-Change-Number: 43147 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Attention: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: RFC: sim/class_tables: add a size attribute
by lynxis lazus 07 Aug '26

07 Aug '26

lynxis lazus has uploaded a new patch set (#2). ( https://gerrit.osmocom.org/c/libosmocore/+/43178?usp=email ) Change subject: RFC: sim/class_tables: add a size attribute ...................................................................... RFC: sim/class_tables: add a size attribute osim_determine_apdu_case() doesn't know the size of the APDU, this may result in reading invalid data outside the APDU. Warning: this is an API breakage! Instead adding a second function osim_determine_apdu_case_size() could allow it. However because the class_tables.h also defines the internal struct with the helper functions, which in turn has the same problem. Change-Id: Iee50063399a0c3b29594e737f44aaa125fd06a2e --- M include/osmocom/sim/class_tables.h M src/sim/class_tables.c M tests/sim/sim_test.c 3 files changed, 30 insertions(+), 16 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/78/43178/2 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43178?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Iee50063399a0c3b29594e737f44aaa125fd06a2e Gerrit-Change-Number: 43178 Gerrit-PatchSet: 2 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[S] Change in libosmocore[master]: sim/class_tables: add a size attribute
by lynxis lazus 07 Aug '26

07 Aug '26

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43178?usp=email ) Change subject: sim/class_tables: add a size attribute ...................................................................... sim/class_tables: add a size attribute osim_determine_apdu_case() doesn't know the size of the APDU, this may result in reading invalid data outside the APDU. Warning: this is an API breakage! Instead adding a second function osim_determine_apdu_case_size() could allow it. However because the class_tables.h also defines the internal struct with the helper functions, which in turn has the same problem. Change-Id: Iee50063399a0c3b29594e737f44aaa125fd06a2e --- M include/osmocom/sim/class_tables.h M src/sim/class_tables.c M tests/sim/sim_test.c 3 files changed, 30 insertions(+), 16 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/78/43178/1 diff --git a/include/osmocom/sim/class_tables.h b/include/osmocom/sim/class_tables.h index ec9ec49..2c7c206 100644 --- a/include/osmocom/sim/class_tables.h +++ b/include/osmocom/sim/class_tables.h @@ -20,7 +20,7 @@ struct osim_cla_ins_case { uint8_t cla; uint8_t cla_mask; - int (*helper)(const struct osim_cla_ins_case *cic, const uint8_t *hdr); + int (*helper)(const struct osim_cla_ins_case *cic, const uint8_t *apdu, size_t apdu_size); const uint8_t *ins_tbl; }; @@ -36,4 +36,4 @@ extern const struct osim_cla_ins_card_profile osim_uicc_sim_cic_profile; int osim_determine_apdu_case(const struct osim_cla_ins_card_profile *prof, - const uint8_t *hdr); + const uint8_t *apdu, size_t apdu_size); diff --git a/src/sim/class_tables.c b/src/sim/class_tables.c index 7500fc5..0a792c6 100644 --- a/src/sim/class_tables.c +++ b/src/sim/class_tables.c @@ -16,6 +16,7 @@ */ #include <stdint.h> +#include <errno.h> #include <osmocom/core/utils.h> #include <osmocom/sim/class_tables.h> @@ -139,13 +140,16 @@ }; static int uicc046_cla_ins_helper(const struct osim_cla_ins_case *cic, - const uint8_t *hdr) + const uint8_t *hdr, size_t hdr_size) { - uint8_t ins = hdr[1]; - uint8_t p1 = hdr[2]; - uint8_t p2 = hdr[3]; - uint8_t p2_cmd; + uint8_t ins, p1, p2, p2_cmd; + if (hdr_size < 4) + return -EINVAL; + + ins = hdr[1]; + p1 = hdr[2]; + p2 = hdr[3]; switch (ins) { case 0x73: /* MANAGE SECURE CHANNEL */ if (p1 == 0x00) /* Retrieve UICC Endpoints */ @@ -182,12 +186,16 @@ } static int gp_cla_ins_helper(const struct osim_cla_ins_case *cic, - const uint8_t *hdr) + const uint8_t *hdr, size_t hdr_size) { - uint8_t ins = hdr[1]; - uint8_t p1 = hdr[2]; - uint8_t p3 = hdr[4]; + uint8_t ins, p1, p3; + if (hdr_size < 5) + return -EINVAL; + + ins = hdr[1]; + p1 = hdr[2]; + p3 = hdr[4]; switch (ins) { case 0xE2: /* STORE DATA */ switch (p1 & 0x01) { @@ -394,13 +402,17 @@ }; int osim_determine_apdu_case(const struct osim_cla_ins_card_profile *prof, - const uint8_t *hdr) + const uint8_t *apdu, size_t apdu_len) { - uint8_t cla = hdr[0]; - uint8_t ins = hdr[1]; + uint8_t cla, ins; int i; int rc; + if (apdu_len < 4) + return -EINVAL; + + cla = apdu[0]; + ins = apdu[1]; for (i = 0; i < prof->cic_arr_size; i++) { const struct osim_cla_ins_case *cic = &prof->cic_arr[i]; if ((cla & cic->cla_mask) != cic->cla) @@ -408,7 +420,8 @@ rc = cic->ins_tbl[ins]; switch (rc) { case 0x80: - return cic->helper(cic, hdr); + /* the length of the hdr is unknown */ + return cic->helper(cic, apdu, apdu_len); case 0x00: /* continue with further cic, rather than abort * now */ diff --git a/tests/sim/sim_test.c b/tests/sim/sim_test.c index ab5d2be..801c559 100644 --- a/tests/sim/sim_test.c +++ b/tests/sim/sim_test.c @@ -19,6 +19,7 @@ #include <string.h> #include <osmocom/sim/sim.h> +#include <osmocom/core/utils.h> #include <osmocom/sim/class_tables.h> const uint8_t sim_sel_mf[] = { 0xA0, 0xA4, 0x00, 0x00, 0x02, 0x3F, 0x00 }; @@ -35,7 +36,7 @@ #define APDU_CASE_ASSERT(x, y) \ do { \ printf("Testing " #x "\n"); \ - int rc = osim_determine_apdu_case(&osim_uicc_sim_cic_profile, x); \ + int rc = osim_determine_apdu_case(&osim_uicc_sim_cic_profile, x, ARRAY_SIZE(x)); \ if (rc != y) \ printf("%d (actual) != %d (intended)\n", rc, y); \ OSMO_ASSERT(rc == y); \ -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43178?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Iee50063399a0c3b29594e737f44aaa125fd06a2e Gerrit-Change-Number: 43178 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XS] Change in libsmpp34[master]: smpp34_unpack: bound C_OCTET scan with strnlen()
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded a new patch set (#3). ( https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email ) Change subject: smpp34_unpack: bound C_OCTET scan with strnlen() ...................................................................... smpp34_unpack: bound C_OCTET scan with strnlen() The C_OCTET macro runs strlen() on the attacker-controlled wire buffer before any bounds check. SMPP PDUs are decoded straight out of a buffer sized exactly to the wire command_length with no trailing NUL, so a C-Octet-String field that runs to the end of the buffer without a terminator makes strlen() read past the end of the allocation (out of bounds heap read), and the post-hoc "lenval > left" check runs only after the over-read has already happened. Scan with strnlen(aux, left) so the read can never go past the remaining buffer; if no terminator is found within 'left' bytes, lenval becomes left + 1 and the existing length check rejects the PDU. This issue has been assigned the CVE candidate identifier CAN-2026-2051038. Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 --- M src/smpp34_unpack.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libsmpp34 refs/changes/89/42889/3 -- To view, visit https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libsmpp34 Gerrit-Branch: master Gerrit-Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 Gerrit-Change-Number: 42889 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

[S] Change in osmo-iuh[master]: iu_client: reject oversized RANAP NAS-PDU
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded a new patch set (#3). ( https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email ) Change subject: iu_client: reject oversized RANAP NAS-PDU ...................................................................... iu_client: reject oversized RANAP NAS-PDU The connection-oriented RANAP handlers ranap_handle_co_initial_ue() and ranap_handle_co_dt() copy the attacker-controlled NAS-PDU into a msgb allocated with a fixed 256 bytes. RANAP NAS-PDU is an unconstrained OCTET STRING, so the APER decoder accepts an arbitrarily large PDU; when nas_pdu.size exceeds the msgb tailroom, msgb_put() hits MSGB_ABORT and osmo_panic()s the process (MSGB_DEBUG is compiled in unconditionally), which a femtocell (HNB) peer can use to crash osmo-hnbgw / osmo-hnodeb by sending an InitialUE or DirectTransfer with a NAS-PDU > 256 bytes. Validate nas_pdu.size against the msgb tailroom and drop the message gracefully instead of panicking. This issue has been assigned the CVE candidate identifier CAN-2026-2051037. Change-Id: I7dbce926477f9842cd466d46cda836638f04011f --- M src/iu_client.c 1 file changed, 12 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-iuh refs/changes/87/42887/3 -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I7dbce926477f9842cd466d46cda836638f04011f Gerrit-Change-Number: 42887 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

[XS] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded a new patch set (#3). ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... ipaccess-proxy: reject oversized IPA frame length ipaccess_proxy_read_msg() reads the 16-bit IPA frame length from the wire header and passes it straight as the recv() count into a msgb that was allocated with a fixed PROXY_ALLOC_SIZE (1200) bytes, without ever checking it against the buffer tailroom. A peer that advertises a body length larger than the remaining buffer space makes recv() write past the end of the heap allocation (heap buffer overflow). Reject frames whose advertised length exceeds the msgb tailroom, the same way the other IPA read paths bound the read to msgb_tailroom(). This issue has been assigned the CVE candidate identifier CAN-2026-2051036. Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 6 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/86/42886/3 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026