August 2026 - gerrit-log - lists.osmocom.org

[S] Change in osmo-sgsn[master]: ranap: reject oversized RANAP NAS-PDU
by pespin 20 Aug '26

20 Aug '26

Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43323?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder Change subject: ranap: reject oversized RANAP NAS-PDU ...................................................................... ranap: reject oversized RANAP NAS-PDU The connection-oriented RANAP handlers ranap_handle_co_initial_ue() and ranap_handle_co_dt() copy the attacker-controlled NAS-PDU into a msgb allocated with a fixed 256 bytes. RANAP NAS-PDU is an unconstrained OCTET STRING, so the APER decoder accepts an arbitrarily large PDU; when nas_pdu.size exceeds the msgb tailroom, msgb_put() hits MSGB_ABORT and osmo_panic()s the process (MSGB_DEBUG is compiled in unconditionally), which a femtocell (HNB) peer can use to crash osmo-hnbgw / osmo-hnodeb by sending an InitialUE or DirectTransfer with a NAS-PDU > 256 bytes. Validate nas_pdu.size against the msgb tailroom and drop the message gracefully instead of panicking. This issue has been assigned the CVE candidate identifier CAN-2026-2051037. This is a backport from osmo-iuh.git f06967126f486bcb185ccf3d1a8f9bc02c4da1f6 Change-Id: I2090c7acbf861dfc295a82ef32a976ea7742438b --- M src/sgsn/gprs_ranap.c 1 file changed, 14 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/23/43323/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43323?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: I2090c7acbf861dfc295a82ef32a976ea7742438b Gerrit-Change-Number: 43323 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder

1 0

[XS] Change in osmo-sgsn[master]: ranap: reject oversized RANAP NAS-PDU
by pespin 20 Aug '26

20 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43323?usp=email ) Change subject: ranap: reject oversized RANAP NAS-PDU ...................................................................... ranap: reject oversized RANAP NAS-PDU The connection-oriented RANAP handlers ranap_handle_co_initial_ue() and ranap_handle_co_dt() copy the attacker-controlled NAS-PDU into a msgb allocated with a fixed 256 bytes. RANAP NAS-PDU is an unconstrained OCTET STRING, so the APER decoder accepts an arbitrarily large PDU; when nas_pdu.size exceeds the msgb tailroom, msgb_put() hits MSGB_ABORT and osmo_panic()s the process (MSGB_DEBUG is compiled in unconditionally), which a femtocell (HNB) peer can use to crash osmo-hnbgw / osmo-hnodeb by sending an InitialUE or DirectTransfer with a NAS-PDU > 256 bytes. Validate nas_pdu.size against the msgb tailroom and drop the message gracefully instead of panicking. This issue has been assigned the CVE candidate identifier CAN-2026-2051037. This is a backport from osmo-iuh.git f06967126f486bcb185ccf3d1a8f9bc02c4da1f6 Change-Id: I2090c7acbf861dfc295a82ef32a976ea7742438b --- M src/sgsn/gprs_ranap.c 1 file changed, 7 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/23/43323/1 diff --git a/src/sgsn/gprs_ranap.c b/src/sgsn/gprs_ranap.c index 70b1260..6f068d7 100644 --- a/src/sgsn/gprs_ranap.c +++ b/src/sgsn/gprs_ranap.c @@ -405,6 +405,13 @@ } sai = asn1str_to_u16(&ies->sai.sAC); + if (ies->nas_pdu.size > msgb_tailroom(msg)) { + LOGP(DRANAP, LOGL_ERROR, + "RANAP InitialUE: NAS-PDU size %d > tailroom %d, dropping\n", + ies->nas_pdu.size, msgb_tailroom(msg)); + msgb_free(msg); + return -1; + } msgb_gmmh(msg) = msgb_put(msg, ies->nas_pdu.size); memcpy(msgb_gmmh(msg), ies->nas_pdu.buf, ies->nas_pdu.size); -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43323?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: I2090c7acbf861dfc295a82ef32a976ea7742438b Gerrit-Change-Number: 43323 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-iuh[master]: Bump version: 1.8.0.4-662e-dirty → 1.8.1
by pespin 20 Aug '26

20 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43320?usp=email ) Change subject: Bump version: 1.8.0.4-662e-dirty → 1.8.1 ...................................................................... Bump version: 1.8.0.4-662e-dirty → 1.8.1 Change-Id: I343c885a93d5ab71816821e85a0a414b00006863 --- M TODO-RELEASE M debian/changelog M src/Makefile.am 3 files changed, 14 insertions(+), 2 deletions(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, approved diff --git a/TODO-RELEASE b/TODO-RELEASE index dad7e1f..0ed7189 100644 --- a/TODO-RELEASE +++ b/TODO-RELEASE @@ -7,4 +7,3 @@ # If any interfaces have been added since the last public release: c:r:a + 1. # If any interfaces have been removed or changed since the last public release: c:r:0. #library what description / commit summary line -add ranap ranap_new_msg_rab_assign_voice2(), ranap_new_msg_rab_assign_data2() diff --git a/debian/changelog b/debian/changelog index 9a373c8..edbddeb 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,16 @@ +osmo-iuh (1.8.1) unstable; urgency=medium + + [ n0k0 ] + * iu_client: reject oversized RANAP NAS-PDU + + [ Pau Espin Pedrol ] + * iu_helpers: Constify osmo_sockaddr input param + * ranap_msg_factory: Fix API documentation regarding ip param endianness + * ranap: Introduce new APIs to encode rab_ass for gtp and rtp + * ranap: Fix msgb leak on decode error paths + + -- Pau Espin Pedrol <pespin(a)sysmocom.de> Thu, 20 Aug 2026 12:09:27 +0200 + osmo-iuh (1.8.0) unstable; urgency=medium [ Pau Espin Pedrol ] diff --git a/src/Makefile.am b/src/Makefile.am index 3209211..343fa53 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -62,7 +62,7 @@ # build the shared RANAP + SABP library # HNBAP_LIBVERSION=2:0:2 -RANAP_LIBVERSION=11:0:4 +RANAP_LIBVERSION=12:0:5 RUA_LIBVERSION=2:0:2 SABP_LIBVERSION=3:0:2 lib_LTLIBRARIES = libosmo-hnbap.la libosmo-ranap.la libosmo-rua.la libosmo-sabp.la -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43320?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I343c885a93d5ab71816821e85a0a414b00006863 Gerrit-Change-Number: 43320 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-iuh[master]: Bump version: 1.8.0.4-662e-dirty → 1.8.1
by pespin 20 Aug '26

20 Aug '26

pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43320?usp=email ) Change subject: Bump version: 1.8.0.4-662e-dirty → 1.8.1 ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43320?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I343c885a93d5ab71816821e85a0a414b00006863 Gerrit-Change-Number: 43320 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 20 Aug 2026 10:17:06 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-iuh[master]: Bump version: 1.8.0.4-662e-dirty → 1.8.1
by pespin 20 Aug '26

20 Aug '26

Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-iuh/+/43320?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder Change subject: Bump version: 1.8.0.4-662e-dirty → 1.8.1 ...................................................................... Bump version: 1.8.0.4-662e-dirty → 1.8.1 Change-Id: I343c885a93d5ab71816821e85a0a414b00006863 --- M TODO-RELEASE M debian/changelog M src/Makefile.am 3 files changed, 14 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-iuh refs/changes/20/43320/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43320?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I343c885a93d5ab71816821e85a0a414b00006863 Gerrit-Change-Number: 43320 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-iuh[master]: ranap: Fix msgb leak on decode error paths
by pespin 20 Aug '26

20 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43321?usp=email ) Change subject: ranap: Fix msgb leak on decode error paths ...................................................................... ranap: Fix msgb leak on decode error paths Change-Id: I58ef8f227d177dc1e99d2c342dd7d5fd6e5b3747 --- M src/iu_client.c 1 file changed, 4 insertions(+), 0 deletions(-) Approvals: osmith: Looks good to me, approved Jenkins Builder: Verified diff --git a/src/iu_client.c b/src/iu_client.c index 993a0e0..8df8c7d 100644 --- a/src/iu_client.c +++ b/src/iu_client.c @@ -461,6 +461,7 @@ if (ranap_parse_lai(&ra_id, &ies->lai) != 0) { LOGPIU(LOGL_ERROR, "Failed to parse RANAP LAI IE\n"); + msgb_free(msg); return -1; } @@ -469,6 +470,7 @@ if (ra_id.rac == OSMO_RESERVED_RAC) { LOGPIU(LOGL_ERROR, "Rejecting RNC with invalid/internally used RAC 0x%02x\n", ra_id.rac); + msgb_free(msg); return -1; } } else { @@ -478,6 +480,7 @@ if (iu_grnc_id_parse(&rnc_id, &ies->globalRNC_ID) != 0) { LOGPIU(LOGL_ERROR, "Failed to parse RANAP Global-RNC-ID IE\n"); + msgb_free(msg); return -1; } @@ -518,6 +521,7 @@ if (ies->presenceMask & DIRECTTRANSFERIES_RANAP_LAI_PRESENT) { if (ranap_parse_lai(&_ra_id, &ies->lai) != 0) { LOGPIU(LOGL_ERROR, "Failed to parse RANAP LAI IE\n"); + msgb_free(msg); return -1; } ra_id = &_ra_id; -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43321?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I58ef8f227d177dc1e99d2c342dd7d5fd6e5b3747 Gerrit-Change-Number: 43321 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-iuh[master]: Bump version: 1.8.0.4-662e-dirty → 1.8.1
by pespin 20 Aug '26

20 Aug '26

pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43320?usp=email ) Change subject: Bump version: 1.8.0.4-662e-dirty → 1.8.1 ...................................................................... Patch Set 1: Code-Review-2 -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43320?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I343c885a93d5ab71816821e85a0a414b00006863 Gerrit-Change-Number: 43320 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 20 Aug 2026 10:07:39 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-sgsn[master]: ranap: Fix msgb leak on decode error paths
by osmith 20 Aug '26

20 Aug '26

Attention is currently required from: pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43322?usp=email ) Change subject: ranap: Fix msgb leak on decode error paths ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43322?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: I4dcd7efc39c3cde052bbd258e4bdd3d13ccf7467 Gerrit-Change-Number: 43322 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 20 Aug 2026 10:04:48 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-sgsn[master]: ranap: Fix msgb leak on decode error paths
by pespin 20 Aug '26

20 Aug '26

pespin has uploaded a new patch set (#2). ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43322?usp=email ) Change subject: ranap: Fix msgb leak on decode error paths ...................................................................... ranap: Fix msgb leak on decode error paths Related: osmo-iuh.git Change-Id I58ef8f227d177dc1e99d2c342dd7d5fd6e5b3747 Change-Id: I4dcd7efc39c3cde052bbd258e4bdd3d13ccf7467 --- M src/sgsn/gprs_ranap.c 1 file changed, 5 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/22/43322/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43322?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: I4dcd7efc39c3cde052bbd258e4bdd3d13ccf7467 Gerrit-Change-Number: 43322 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-sgsn[master]: ranap: Fix msgb leak on decode error paths
by pespin 20 Aug '26

20 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43322?usp=email ) Change subject: ranap: Fix msgb leak on decode error paths ...................................................................... ranap: Fix msgb leak on decode error paths Change-Id: I4dcd7efc39c3cde052bbd258e4bdd3d13ccf7467 --- M src/sgsn/gprs_ranap.c 1 file changed, 5 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/22/43322/1 diff --git a/src/sgsn/gprs_ranap.c b/src/sgsn/gprs_ranap.c index 4445235..70b1260 100644 --- a/src/sgsn/gprs_ranap.c +++ b/src/sgsn/gprs_ranap.c @@ -379,11 +379,13 @@ if (ranap_parse_lai(&ra_id, &ies->lai) != 0) { LOGP(DRANAP, LOGL_ERROR, "Failed to parse RANAP LAI IE\n"); + msgb_free(msg); return -1; } if (!(ies->presenceMask & INITIALUE_MESSAGEIES_RANAP_RAC_PRESENT)) { LOGP(DRANAP, LOGL_ERROR, "Rejecting InitialUE msg without RAC IE\n"); + msgb_free(msg); return -1; } @@ -391,12 +393,14 @@ if (ra_id.rac == OSMO_RESERVED_RAC) { LOGP(DRANAP, LOGL_ERROR, "Rejecting RNC with invalid/internally used RAC 0x%02x\n", ra_id.rac); + msgb_free(msg); return -1; } if (iu_grnc_id_parse(&rnc_id, &ies->globalRNC_ID) != 0) { LOGP(DRANAP, LOGL_ERROR, "Failed to parse RANAP Global-RNC-ID IE\n"); + msgb_free(msg); return -1; } @@ -493,6 +497,7 @@ if (ies->presenceMask & DIRECTTRANSFERIES_RANAP_LAI_PRESENT) { if (ranap_parse_lai(&_ra_id, &ies->lai) != 0) { LOGP(DRANAP, LOGL_ERROR, "Failed to parse RANAP LAI IE\n"); + msgb_free(msg); return -1; } ra_id = &_ra_id; -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43322?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: I4dcd7efc39c3cde052bbd258e4bdd3d13ccf7467 Gerrit-Change-Number: 43322 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026