Attention is currently required from: dexter, laforge, lynxis lazus.
Hello Jenkins Builder, dexter, laforge,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/simtrace2/+/43185?usp=email
to look at the new patch set (#5).
The following approvals got outdated and were removed:
Verified-1 by Jenkins Builder
Change subject: Add osmo_apdu_segment_in2() to ensure correct parsing of GP GET DATA
......................................................................
Add osmo_apdu_segment_in2() to ensure correct parsing of GP GET DATA
osmo_apdu_segment_in() doesn't have the context of the previous APDU,
for nearly all calls this is fine, except for GP GET DATA, which can be
a case 2 or case 4 APDU.
GP GET DATA defines the Le field as 0x00 which is used by osmo_apdu_segment_in
to detect if it is a case 2 or case 4.
But if the card responded to a case 2 GP GET DATA with Le = 0 with a
SW 6cXX, the previous GP GET DATA case 2 must resent with a Le field to XX,
which got misinterpreted by the osmo_apdu_segment_in() as a case 4
instead of a case 2 with Le != 0.
Introduce osmo_apdu_segment_in2() containing the previous APDU as
context.
Modem <-> Card
81cadf2000 ->
<- 6c0b
81cadf200b ->
-- waits for more data, because it decodes the last TPDU as a case 4 instead of a case 2.
Related: SYS#8147
Change-Id: Ie238662e7e6a10dd4283ede0c8d8d73bc375c247
---
M TODO-RELEASE
M host/Makefile.am
M host/configure.ac
M host/include/osmocom/simtrace2/apdu_dispatch.h
M host/lib/apdu_dispatch.c
A host/tests/Makefile.am
A host/tests/apdu_dispatch/Makefile.am
A host/tests/apdu_dispatch/apdu_dispatch_test.c
A host/tests/apdu_dispatch/apdu_dispatch_test.ok
A host/tests/testsuite.at
10 files changed, 196 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/simtrace2 refs/changes/85/43185/5
--
To view, visit https://gerrit.osmocom.org/c/simtrace2/+/43185?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: simtrace2
Gerrit-Branch: master
Gerrit-Change-Id: Ie238662e7e6a10dd4283ede0c8d8d73bc375c247
Gerrit-Change-Number: 43185
Gerrit-PatchSet: 5
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email )
Change subject: constr_CHOICE: fix always-true bounds check
......................................................................
constr_CHOICE: fix always-true bounds check
The guard around the td->elements[present - 1] access uses
"present > 0 || present <= td->elements_count". Because every int
satisfies at least one of the two clauses, the condition is always true,
so a present index of 0 or one greater than elements_count indexes the
elements array out of bounds (out of bounds read).
Use "&&" so the access is taken only when present is within
[1, elements_count], matching the equivalent checks already used in
CHOICE_constraint() and the print/compare helpers in this file.
Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf
---
M src/constr_CHOICE.c
1 file changed, 1 insertion(+), 1 deletion(-)
Approvals:
pespin: Looks good to me, but someone else must approve
laforge: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/src/constr_CHOICE.c b/src/constr_CHOICE.c
index df68feb..4397ad1 100644
--- a/src/constr_CHOICE.c
+++ b/src/constr_CHOICE.c
@@ -457,7 +457,7 @@
*/
present = _fetch_present_idx(ptr, specs->pres_offset, specs->pres_size);
- if(present > 0 || present <= td->elements_count) {
+ if (present > 0 && present <= td->elements_count) {
const asn_TYPE_member_t *elm = &td->elements[present-1];
const void *memb_ptr;
--
To view, visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libasn1c
Gerrit-Branch: master
Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf
Gerrit-Change-Number: 42890
Gerrit-PatchSet: 4
Gerrit-Owner: n0k0 <osmocom(a)hacky.software>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Gerrit-CC: lynxis lazus <lynxis(a)fe80.eu>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email )
Change subject: smpp34_unpack: bound C_OCTET scan with strnlen()
......................................................................
smpp34_unpack: bound C_OCTET scan with strnlen()
The C_OCTET macro runs strlen() on the attacker-controlled wire buffer
before any bounds check. SMPP PDUs are decoded straight out of a buffer
sized exactly to the wire command_length with no trailing NUL, so a
C-Octet-String field that runs to the end of the buffer without a
terminator makes strlen() read past the end of the allocation (out of
bounds heap read), and the post-hoc "lenval > left" check runs only
after the over-read has already happened.
Scan with strnlen(aux, left) so the read can never go past the remaining
buffer; if no terminator is found within 'left' bytes, lenval becomes
left + 1 and the existing length check rejects the PDU.
This issue has been assigned the CVE candidate identifier
CAN-2026-2051038.
Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814
---
M src/smpp34_unpack.c
1 file changed, 1 insertion(+), 1 deletion(-)
Approvals:
Jenkins Builder: Verified
pespin: Looks good to me, but someone else must approve
laforge: Looks good to me, approved
diff --git a/src/smpp34_unpack.c b/src/smpp34_unpack.c
index ec73d35..47d34ba 100644
--- a/src/smpp34_unpack.c
+++ b/src/smpp34_unpack.c
@@ -127,7 +127,7 @@
#define C_OCTET( inst, par, size ){\
- lenval = strlen( (char*) aux ) + 1;\
+ lenval = strnlen((char *)aux, left) + 1;\
if( lenval > left ){\
PUTLOG("[len(%s):%d(%s)]", par, lenval, \
"Value length exceed buffer length");\
--
To view, visit https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libsmpp34
Gerrit-Branch: master
Gerrit-Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814
Gerrit-Change-Number: 42889
Gerrit-PatchSet: 4
Gerrit-Owner: n0k0 <osmocom(a)hacky.software>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email )
Change subject: iu_client: reject oversized RANAP NAS-PDU
......................................................................
iu_client: reject oversized RANAP NAS-PDU
The connection-oriented RANAP handlers ranap_handle_co_initial_ue() and
ranap_handle_co_dt() copy the attacker-controlled NAS-PDU into a msgb
allocated with a fixed 256 bytes. RANAP NAS-PDU is an unconstrained
OCTET STRING, so the APER decoder accepts an arbitrarily large PDU; when
nas_pdu.size exceeds the msgb tailroom, msgb_put() hits MSGB_ABORT and
osmo_panic()s the process (MSGB_DEBUG is compiled in unconditionally),
which a femtocell (HNB) peer can use to crash osmo-hnbgw / osmo-hnodeb
by sending an InitialUE or DirectTransfer with a NAS-PDU > 256 bytes.
Validate nas_pdu.size against the msgb tailroom and drop the message
gracefully instead of panicking.
This issue has been assigned the CVE candidate identifier
CAN-2026-2051037.
Change-Id: I7dbce926477f9842cd466d46cda836638f04011f
---
M src/iu_client.c
1 file changed, 12 insertions(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
pespin: Looks good to me, but someone else must approve
fixeria: Looks good to me, approved
laforge: Looks good to me, approved
diff --git a/src/iu_client.c b/src/iu_client.c
index 5de1826..993a0e0 100644
--- a/src/iu_client.c
+++ b/src/iu_client.c
@@ -482,6 +482,12 @@
}
sai = asn1str_to_u16(&ies->sai.sAC);
+ if (ies->nas_pdu.size > msgb_tailroom(msg)) {
+ LOGPIU(LOGL_ERROR, "RANAP InitialUE: NAS-PDU size %d > tailroom %d, dropping\n",
+ ies->nas_pdu.size, msgb_tailroom(msg));
+ msgb_free(msg);
+ return -1;
+ }
msgb_gmmh(msg) = msgb_put(msg, ies->nas_pdu.size);
memcpy(msgb_gmmh(msg), ies->nas_pdu.buf, ies->nas_pdu.size);
@@ -524,6 +530,12 @@
}
}
+ if (ies->nas_pdu.size > msgb_tailroom(msg)) {
+ LOGPIU(LOGL_ERROR, "RANAP DirectTransfer: NAS-PDU size %d > tailroom %d, dropping\n",
+ ies->nas_pdu.size, msgb_tailroom(msg));
+ msgb_free(msg);
+ return -1;
+ }
msgb_gmmh(msg) = msgb_put(msg, ies->nas_pdu.size);
memcpy(msgb_gmmh(msg), ies->nas_pdu.buf, ies->nas_pdu.size);
--
To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-iuh
Gerrit-Branch: master
Gerrit-Change-Id: I7dbce926477f9842cd466d46cda836638f04011f
Gerrit-Change-Number: 42887
Gerrit-PatchSet: 3
Gerrit-Owner: n0k0 <osmocom(a)hacky.software>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ggsn/+/42885?usp=email )
(
3 is the latest approved patch-set.
No files were changed between the latest approved patch-set and the submitted one.
)Change subject: gtp: fix OOB write in PDP ctx GSN-Address decode
......................................................................
gtp: fix OOB write in PDP ctx GSN-Address decode
gtp_decode_pdp_ctx() takes the GSN-Address sub-field lengths of a PDP
Context IE (gsnrc / gsnru, the GGSN control- and user-plane addresses)
straight from the wire and memcpy()s that many bytes into the fixed
16-byte 'struct ul16_t' v[] array, with no check against the destination
size. decode_pdp_ctx_len_check() only validates the declared lengths
against the *input* buffer, never against the destination capacity, so a
wire length of 17..255 overflows the 16-byte field by up to 239 bytes,
clobbering adjacent struct pdp_t state.
The PDP Context IE is carried in SGSN Context Response / Forward
Relocation messages exchanged between peer GSNs over Gn/Gp, so a
malicious or spoofed peer GSN can trigger this. The same libgtp decoder
is linked by osmo-sgsn, so it is affected as well.
A GSN address is 4 (IPv4) or 16 (IPv6) bytes, so reject any length that
does not fit the destination before copying.
This issue has been assigned the CVE candidate identifier
CAN-2026-2051035.
Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98
---
M gtp/gtp.c
1 file changed, 12 insertions(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
pespin: Looks good to me, but someone else must approve
fixeria: Looks good to me, approved
diff --git a/gtp/gtp.c b/gtp/gtp.c
index 7a439d9..f378c17 100644
--- a/gtp/gtp.c
+++ b/gtp/gtp.c
@@ -1245,12 +1245,24 @@
/* GGSN Address Ctrl */
pdp->gsnrc.l = *ptr;
ptr++;
+ if (pdp->gsnrc.l > sizeof(pdp->gsnrc.v)) {
+ LOGP(DLGTP, LOGL_ERROR,
+ "PDP Context Decode: GSN Address (Ctrl) length %u exceeds %zu\n",
+ pdp->gsnrc.l, sizeof(pdp->gsnrc.v));
+ return -EINVAL;
+ }
memcpy(pdp->gsnrc.v, ptr, pdp->gsnrc.l);
ptr += pdp->gsnrc.l;
/* GGSN Address User */
pdp->gsnru.l = *ptr;
ptr++;
+ if (pdp->gsnru.l > sizeof(pdp->gsnru.v)) {
+ LOGP(DLGTP, LOGL_ERROR,
+ "PDP Context Decode: GSN Address (User) length %u exceeds %zu\n",
+ pdp->gsnru.l, sizeof(pdp->gsnru.v));
+ return -EINVAL;
+ }
memcpy(pdp->gsnru.v, ptr, pdp->gsnru.l);
ptr += pdp->gsnru.l;
--
To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/42885?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-ggsn
Gerrit-Branch: master
Gerrit-Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98
Gerrit-Change-Number: 42885
Gerrit-PatchSet: 4
Gerrit-Owner: n0k0 <osmocom(a)hacky.software>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de>
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Attention is currently required from: dexter, laforge.
lynxis lazus has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/simtrace2/+/43185?usp=email )
Change subject: Add osmo_apdu_segment_in2() to ensure correct parsing of GP GET DATA
......................................................................
Patch Set 4:
(2 comments)
Commit Message:
https://gerrit.osmocom.org/c/simtrace2/+/43185/comment/6c13b72e_8a33acfe?us… :
PS3, Line 9: osmo_apdu_segment_in() don't have the context of the previous APDU,
> don't => does not
Done
https://gerrit.osmocom.org/c/simtrace2/+/43185/comment/2a7d16ba_e6104c7d?us… :
PS3, Line 12: GP GET DATA defines the Le field as 0x00 which is used to detect if this
> this => it
Done
--
To view, visit https://gerrit.osmocom.org/c/simtrace2/+/43185?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: simtrace2
Gerrit-Branch: master
Gerrit-Change-Id: Ie238662e7e6a10dd4283ede0c8d8d73bc375c247
Gerrit-Change-Number: 43185
Gerrit-PatchSet: 4
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
Gerrit-Comment-Date: Wed, 12 Aug 2026 12:18:08 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>
Attention is currently required from: dexter, laforge, lynxis lazus.
Hello Jenkins Builder, dexter, laforge,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/simtrace2/+/43185?usp=email
to look at the new patch set (#4).
The following approvals got outdated and were removed:
Code-Review+1 by dexter, Verified+1 by Jenkins Builder
Change subject: Add osmo_apdu_segment_in2() to ensure correct parsing of GP GET DATA
......................................................................
Add osmo_apdu_segment_in2() to ensure correct parsing of GP GET DATA
osmo_apdu_segment_in() doesn't have the context of the previous APDU,
for nearly all calls this is fine, except for GP GET DATA, which can be
a case 2 or case 4 APDU.
GP GET DATA defines the Le field as 0x00 which is used by osmo_apdu_segment_in
to detect if it is a case 2 or case 4.
But if the card responded to a case 2 GP GET DATA with Le = 0 with a
SW 6cXX, the previous GP GET DATA case 2 must resent with a Le field to XX,
which got misinterpreted by the osmo_apdu_segment_in() as a case 4
instead of a case 2 with Le != 0.
Introduce osmo_apdu_segment_in2() containing the previous APDU as
context.
Modem <-> Card
81cadf2000 ->
<- 6c0b
81cadf200b ->
-- waits for more data, because it decodes the last TPDU as a case 4 instead of a case 2.
Related: SYS#8147
Change-Id: Ie238662e7e6a10dd4283ede0c8d8d73bc375c247
---
M TODO-RELEASE
M host/Makefile.am
M host/configure.ac
M host/include/osmocom/simtrace2/apdu_dispatch.h
M host/lib/apdu_dispatch.c
A host/tests/apdu_dispatch/Makefile.am
A host/tests/apdu_dispatch/apdu_dispatch_test.c
A host/tests/apdu_dispatch/apdu_dispatch_test.ok
A host/tests/testsuite.at
9 files changed, 156 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/simtrace2 refs/changes/85/43185/4
--
To view, visit https://gerrit.osmocom.org/c/simtrace2/+/43185?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: simtrace2
Gerrit-Branch: master
Gerrit-Change-Id: Ie238662e7e6a10dd4283ede0c8d8d73bc375c247
Gerrit-Change-Number: 43185
Gerrit-PatchSet: 4
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>