August 2026 - gerrit-log - lists.osmocom.org

[S] Change in osmo-ggsn[master]: gtp: fix OOB write in PDP ctx GSN-Address decode
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded a new patch set (#3). ( https://gerrit.osmocom.org/c/osmo-ggsn/+/42885?usp=email ) Change subject: gtp: fix OOB write in PDP ctx GSN-Address decode ...................................................................... gtp: fix OOB write in PDP ctx GSN-Address decode gtp_decode_pdp_ctx() takes the GSN-Address sub-field lengths of a PDP Context IE (gsnrc / gsnru, the GGSN control- and user-plane addresses) straight from the wire and memcpy()s that many bytes into the fixed 16-byte 'struct ul16_t' v[] array, with no check against the destination size. decode_pdp_ctx_len_check() only validates the declared lengths against the *input* buffer, never against the destination capacity, so a wire length of 17..255 overflows the 16-byte field by up to 239 bytes, clobbering adjacent struct pdp_t state. The PDP Context IE is carried in SGSN Context Response / Forward Relocation messages exchanged between peer GSNs over Gn/Gp, so a malicious or spoofed peer GSN can trigger this. The same libgtp decoder is linked by osmo-sgsn, so it is affected as well. A GSN address is 4 (IPv4) or 16 (IPv6) bytes, so reject any length that does not fit the destination before copying. This issue has been assigned the CVE candidate identifier CAN-2026-2051035. Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98 --- M gtp/gtp.c 1 file changed, 12 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ggsn refs/changes/85/42885/3 -- To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/42885?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-ggsn Gerrit-Branch: master Gerrit-Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98 Gerrit-Change-Number: 42885 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

[M] Change in pysim[master]: GP: LOAD/STORE DATA chunk size from SCP overhead
by Hoernchen 07 Aug '26

07 Aug '26

Attention is currently required from: dexter, laforge. Hoernchen has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/pysim/+/43172?usp=email ) Change subject: GP: LOAD/STORE DATA chunk size from SCP overhead ...................................................................... Patch Set 2: (2 comments) File pySim/global_platform/__init__.py: https://gerrit.osmocom.org/c/pysim/+/43172/comment/b9400ec7_a4658458?usp=em… : PS1, Line 871: load_parser.add_argument('--chunk-len', type=auto_uint8, default=None, > (cosmetic, no blocker) as far as I know the default is always None, no need to set it explicitly. I wanted to make sure that auto uint8 as None is a deliberate default, not accidental implicit None. File pySim/global_platform/scp.py: https://gerrit.osmocom.org/c/pysim/+/43172/comment/1fba4d61_33286b2f?usp=em… : PS1, Line 195: # is one byte less than the largest block-size multiple within 255 - mac_len. > Would be nice to have a spec reference here (for the interested reader). there you go, it's just standard aes... -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 Gerrit-Change-Number: 43172 Gerrit-PatchSet: 2 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 11:51:13 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[M] Change in pysim[master]: GP: LOAD/STORE DATA chunk size from SCP overhead
by Hoernchen 07 Aug '26

07 Aug '26

Attention is currently required from: Hoernchen, dexter, laforge. Hello Jenkins Builder, dexter, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+1 by laforge, Code-Review+2 by dexter, Verified+1 by Jenkins Builder, Verified+1 by dexter The change is no longer submittable: Code-Review and Verified are unsatisfied now. Change subject: GP: LOAD/STORE DATA chunk size from SCP overhead ...................................................................... GP: LOAD/STORE DATA chunk size from SCP overhead SCP.overhead was so far set at construction time (SCP02: 8, SCP03: s_mode), so the C-MAC length only. Unfortunately sec lvl >= 3 pads the data field to the cipher block size before encryption, so the real worst-case overhead is larger, scc.max_cmd_len (255 - overhead) was too big, and ADF_SD.load() used a hardcoded chunk_len=240. Real world issue with a 286 byte CAP + SCP02 + sec lvl 3: - 240-byte LOAD block is padded to 248, - encrypted - gets 8 byte C-MAC appended -> Lc = 256 That dies with a weird "ValueError: bytes must be in range(0, 256)". The only "fix" for that was to downgrade the seclevel. STORE DATA has the same overflow with large max_cmd_len (247 + padding + MAC = 256 as well). Therefore the overhead must be properly calculated from the sec level. While at it adjust the error in case I missed something to get a more useful ValueError. Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 --- M pySim/global_platform/__init__.py M pySim/global_platform/scp.py M tests/unittests/test_globalplatform.py 3 files changed, 224 insertions(+), 12 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/72/43172/2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 Gerrit-Change-Number: 43172 Gerrit-PatchSet: 2 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de>

1 0

[M] Change in ...pyosmocom[master]: tlv: preserve the comprehension bit
by dexter 07 Aug '26

07 Aug '26

Attention is currently required from: Hoernchen. dexter has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/python/pyosmocom/+/43171?usp=email ) Change subject: tlv: preserve the comprehension bit ...................................................................... Patch Set 1: Code-Review+1 (5 comments) Patchset: PS1: I have looked through your patch and I think it is plausible, however it introduces a state that other TLV classes don't have. Maybe this needs some explanation. Commit Message: https://gerrit.osmocom.org/c/python/pyosmocom/+/43171/comment/fec56f4a_fb90… : PS1, Line 35: instead of setting the flag, currently tag=0x8123 -> 0x81a3. I would split this in a separate patch (only if you think this would speed things up, as I think this part would be ready at least.) File src/osmocom/tlv.py: https://gerrit.osmocom.org/c/python/pyosmocom/+/43171/comment/4228f038_52c1… : PS1, Line 658: # True/False: as received Maybe it makes sense to explain this property in greater detail? This is an additional state an API user would expect right away. I understand this as a state that flips to the state of the last parsed CR bit when from_tlv() has been used. This basically means that when I have used from_tlv() once, the API user cannot rely on the CR bit set as originally defined. This is probably a corner case as the IE objects are usually short lived and probably not wildly mixed. Decode, change something, Re-Encode is probably the most exciting usecase to expect but I still think we should have an explanatory comment here. File tests/test_tlv.py: https://gerrit.osmocom.org/c/python/pyosmocom/+/43171/comment/873ef7ec_0ebd… : PS1, Line 83: I would add a comment that explains that the first vector has the CR bit set, but the second has not. And both must come out the same when they are decoded and re-encoded. https://gerrit.osmocom.org/c/python/pyosmocom/+/43171/comment/81a1304c_23ed… : PS1, Line 86: ie.from_tlv(encoded) maybe add an assert that checks that ie.comprension has changed state as expected? -- To view, visit https://gerrit.osmocom.org/c/python/pyosmocom/+/43171?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: python/pyosmocom Gerrit-Branch: master Gerrit-Change-Id: Ifae37785e2a586d9130d154bc7244f35fa6f2a55 Gerrit-Change-Number: 43171 Gerrit-PatchSet: 1 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 11:30:55 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[M] Change in pysim[master]: GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13)
by dexter 07 Aug '26

07 Aug '26

Attention is currently required from: Hoernchen, lynxis lazus. dexter has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/pysim/+/43136?usp=email ) Change subject: GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13) ...................................................................... Patch Set 1: Code-Review+1 (2 comments) Patchset: PS1: I would recommend to add an integration test as well. In /tests/pySim-shell_test/gp/test_put_delete_key.script we put an AES128 into the ISD-R of a sysmoEUICC1. We could extend the test so that it also tests the other variants (AES256 and DES) and in particular the AES PSK + DES DEK variant. File pySim/global_platform/__init__.py: https://gerrit.osmocom.org/c/pysim/+/43136/comment/c86af4a1_735aeb55?usp=em… : PS1, Line 655: (b'\x85' + bertlv_encode_len(len(block)) + block + : bytes([len(kcv)]) + kcv) > I would have preferred the use of our object-oriented BER_TLV_IE encoder for the 0x85 as well as som […] Yes, this should definitely handled by a construct definition. -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43136?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I480a9d049a052aa5ae54fe6e2771dba44e89434d Gerrit-Change-Number: 43136 Gerrit-PatchSet: 1 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Fri, 07 Aug 2026 10:17:27 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0

[M] Change in pysim[master]: GP: LOAD/STORE DATA chunk size from SCP overhead
by dexter 07 Aug '26

07 Aug '26

Attention is currently required from: Hoernchen. dexter has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/pysim/+/43172?usp=email ) Change subject: GP: LOAD/STORE DATA chunk size from SCP overhead ...................................................................... Patch Set 1: Code-Review+2 Verified+1 (3 comments) Patchset: PS1: I read through the patch and to me it looks plausible. I also gave it a quick manual test by installing a JAVA applet, which requires SCP02. Before this patch it does not work with Security Level 3, after applying the patch it works with Security Level 3 as well. So I can confirm it works. File pySim/global_platform/__init__.py: https://gerrit.osmocom.org/c/pysim/+/43172/comment/90e5995d_52c3b813?usp=em… : PS1, Line 871: load_parser.add_argument('--chunk-len', type=auto_uint8, default=None, (cosmetic, no blocker) as far as I know the default is always None, no need to set it explicitly. File pySim/global_platform/scp.py: https://gerrit.osmocom.org/c/pysim/+/43172/comment/55117bb9_dd23d59e?usp=em… : PS1, Line 195: # is one byte less than the largest block-size multiple within 255 - mac_len. Would be nice to have a spec reference here (for the interested reader). -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 Gerrit-Change-Number: 43172 Gerrit-PatchSet: 1 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 09:16:08 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XL] Change in osmo-trx[master]: libosmo-trx/client: add TRXC client (command queue) API
by pespin 07 Aug '26

07 Aug '26

Attention is currently required from: fixeria. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/osmo-trx/+/43108?usp=email ) Change subject: libosmo-trx/client: add TRXC client (command queue) API ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-trx/+/43108?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-trx Gerrit-Branch: master Gerrit-Change-Id: I817e394f74a10e3adae4a0b58342c82acdf0794e Gerrit-Change-Number: 43108 Gerrit-PatchSet: 3 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 08:25:24 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[M] Change in ...pyosmocom[master]: tlv: preserve the comprehension bit
by laforge 07 Aug '26

07 Aug '26

Attention is currently required from: Hoernchen, dexter. laforge has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/python/pyosmocom/+/43171?usp=email ) Change subject: tlv: preserve the comprehension bit ...................................................................... Patch Set 1: (1 comment) File src/osmocom/tlv.py: https://gerrit.osmocom.org/c/python/pyosmocom/+/43171/comment/63946c41_418f… : PS1, Line 638: if x.tag > 0xff: : # two byte tag: the comprehension bit is 0x8000! : if x.tag & 0x8000 == 0: : print("Fixing up COMPR_TLV_IE class %s: tag=0x%x has no comprehension bit" % (name, x.tag)) : x.tag = x.tag | 0x8000 > No, because the original condition was AND, so if either part didnt match it would fall through to t […] thanks for the explanation! -- To view, visit https://gerrit.osmocom.org/c/python/pyosmocom/+/43171?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: python/pyosmocom Gerrit-Branch: master Gerrit-Change-Id: Ifae37785e2a586d9130d154bc7244f35fa6f2a55 Gerrit-Change-Number: 43171 Gerrit-PatchSet: 1 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 08:16:21 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Hoernchen <ewild(a)sysmocom.de> Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0

[L] Change in onomondo-eim[master]: esipa_json_handler: Add ESipa JSON bindings
by laforge 07 Aug '26

07 Aug '26

Attention is currently required from: dexter. laforge has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43175?usp=email ) Change subject: esipa_json_handler: Add ESipa JSON bindings ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43175?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Id73ae78a976608fe6f367f8c3b92d8b7b4e195d4 Gerrit-Change-Number: 43175 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 08:15:00 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in onomondo-eim[master]: SGP32Definitions: remove wrong comment about workaround
by laforge 07 Aug '26

07 Aug '26

Attention is currently required from: dexter. laforge has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43174?usp=email ) Change subject: SGP32Definitions: remove wrong comment about workaround ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43174?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Ibba9f380f32ddb947210cedf028460deb22e22ea Gerrit-Change-Number: 43174 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 08:14:15 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0