laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ggsn/+/42885?usp=email ) ( 3 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: gtp: fix OOB write in PDP ctx GSN-Address decode ...................................................................... gtp: fix OOB write in PDP ctx GSN-Address decode gtp_decode_pdp_ctx() takes the GSN-Address sub-field lengths of a PDP Context IE (gsnrc / gsnru, the GGSN control- and user-plane addresses) straight from the wire and memcpy()s that many bytes into the fixed 16-byte 'struct ul16_t' v[] array, with no check against the destination size. decode_pdp_ctx_len_check() only validates the declared lengths against the *input* buffer, never against the destination capacity, so a wire length of 17..255 overflows the 16-byte field by up to 239 bytes, clobbering adjacent struct pdp_t state. The PDP Context IE is carried in SGSN Context Response / Forward Relocation messages exchanged between peer GSNs over Gn/Gp, so a malicious or spoofed peer GSN can trigger this. The same libgtp decoder is linked by osmo-sgsn, so it is affected as well. A GSN address is 4 (IPv4) or 16 (IPv6) bytes, so reject any length that does not fit the destination before copying. This issue has been assigned the CVE candidate identifier CAN-2026-2051035. Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98 --- M gtp/gtp.c 1 file changed, 12 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, approved diff --git a/gtp/gtp.c b/gtp/gtp.c index 7a439d9..f378c17 100644 --- a/gtp/gtp.c +++ b/gtp/gtp.c @@ -1245,12 +1245,24 @@ /* GGSN Address Ctrl */ pdp->gsnrc.l = *ptr; ptr++; + if (pdp->gsnrc.l > sizeof(pdp->gsnrc.v)) { + LOGP(DLGTP, LOGL_ERROR, + "PDP Context Decode: GSN Address (Ctrl) length %u exceeds %zu\n", + pdp->gsnrc.l, sizeof(pdp->gsnrc.v)); + return -EINVAL; + } memcpy(pdp->gsnrc.v, ptr, pdp->gsnrc.l); ptr += pdp->gsnrc.l; /* GGSN Address User */ pdp->gsnru.l = *ptr; ptr++; + if (pdp->gsnru.l > sizeof(pdp->gsnru.v)) { + LOGP(DLGTP, LOGL_ERROR, + "PDP Context Decode: GSN Address (User) length %u exceeds %zu\n", + pdp->gsnru.l, sizeof(pdp->gsnru.v)); + return -EINVAL; + } memcpy(pdp->gsnru.v, ptr, pdp->gsnru.l); ptr += pdp->gsnru.l; -- To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/42885?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ggsn Gerrit-Branch: master Gerrit-Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98 Gerrit-Change-Number: 42885 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom@hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann@sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy@sysmocom.de> Gerrit-Reviewer: laforge <laforge@osmocom.org> Gerrit-Reviewer: pespin <pespin@sysmocom.de>