laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email ) Change subject: iu_client: reject oversized RANAP NAS-PDU ...................................................................... iu_client: reject oversized RANAP NAS-PDU The connection-oriented RANAP handlers ranap_handle_co_initial_ue() and ranap_handle_co_dt() copy the attacker-controlled NAS-PDU into a msgb allocated with a fixed 256 bytes. RANAP NAS-PDU is an unconstrained OCTET STRING, so the APER decoder accepts an arbitrarily large PDU; when nas_pdu.size exceeds the msgb tailroom, msgb_put() hits MSGB_ABORT and osmo_panic()s the process (MSGB_DEBUG is compiled in unconditionally), which a femtocell (HNB) peer can use to crash osmo-hnbgw / osmo-hnodeb by sending an InitialUE or DirectTransfer with a NAS-PDU > 256 bytes. Validate nas_pdu.size against the msgb tailroom and drop the message gracefully instead of panicking. This issue has been assigned the CVE candidate identifier CAN-2026-2051037. Change-Id: I7dbce926477f9842cd466d46cda836638f04011f --- M src/iu_client.c 1 file changed, 12 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, approved laforge: Looks good to me, approved diff --git a/src/iu_client.c b/src/iu_client.c index 5de1826..993a0e0 100644 --- a/src/iu_client.c +++ b/src/iu_client.c @@ -482,6 +482,12 @@ } sai = asn1str_to_u16(&ies->sai.sAC); + if (ies->nas_pdu.size > msgb_tailroom(msg)) { + LOGPIU(LOGL_ERROR, "RANAP InitialUE: NAS-PDU size %d > tailroom %d, dropping\n", + ies->nas_pdu.size, msgb_tailroom(msg)); + msgb_free(msg); + return -1; + } msgb_gmmh(msg) = msgb_put(msg, ies->nas_pdu.size); memcpy(msgb_gmmh(msg), ies->nas_pdu.buf, ies->nas_pdu.size); @@ -524,6 +530,12 @@ } } + if (ies->nas_pdu.size > msgb_tailroom(msg)) { + LOGPIU(LOGL_ERROR, "RANAP DirectTransfer: NAS-PDU size %d > tailroom %d, dropping\n", + ies->nas_pdu.size, msgb_tailroom(msg)); + msgb_free(msg); + return -1; + } msgb_gmmh(msg) = msgb_put(msg, ies->nas_pdu.size); memcpy(msgb_gmmh(msg), ies->nas_pdu.buf, ies->nas_pdu.size); -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I7dbce926477f9842cd466d46cda836638f04011f Gerrit-Change-Number: 42887 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom@hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy@sysmocom.de> Gerrit-Reviewer: laforge <laforge@osmocom.org> Gerrit-Reviewer: pespin <pespin@sysmocom.de>