laforge has submitted this change. (
https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email )
Change subject: iu_client: reject oversized RANAP NAS-PDU
......................................................................
iu_client: reject oversized RANAP NAS-PDU
The connection-oriented RANAP handlers ranap_handle_co_initial_ue() and
ranap_handle_co_dt() copy the attacker-controlled NAS-PDU into a msgb
allocated with a fixed 256 bytes. RANAP NAS-PDU is an unconstrained
OCTET STRING, so the APER decoder accepts an arbitrarily large PDU; when
nas_pdu.size exceeds the msgb tailroom, msgb_put() hits MSGB_ABORT and
osmo_panic()s the process (MSGB_DEBUG is compiled in unconditionally),
which a femtocell (HNB) peer can use to crash osmo-hnbgw / osmo-hnodeb
by sending an InitialUE or DirectTransfer with a NAS-PDU > 256 bytes.
Validate nas_pdu.size against the msgb tailroom and drop the message
gracefully instead of panicking.
This issue has been assigned the CVE candidate identifier
CAN-2026-2051037.
Change-Id: I7dbce926477f9842cd466d46cda836638f04011f
---
M src/iu_client.c
1 file changed, 12 insertions(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
pespin: Looks good to me, but someone else must approve
fixeria: Looks good to me, approved
laforge: Looks good to me, approved
diff --git a/src/iu_client.c b/src/iu_client.c
index 5de1826..993a0e0 100644
--- a/src/iu_client.c
+++ b/src/iu_client.c
@@ -482,6 +482,12 @@
}
sai = asn1str_to_u16(&ies->sai.sAC);
+ if (ies->nas_pdu.size > msgb_tailroom(msg)) {
+ LOGPIU(LOGL_ERROR, "RANAP InitialUE: NAS-PDU size %d > tailroom
%d, dropping\n",
+ ies->nas_pdu.size, msgb_tailroom(msg));
+ msgb_free(msg);
+ return -1;
+ }
msgb_gmmh(msg) = msgb_put(msg, ies->nas_pdu.size);
memcpy(msgb_gmmh(msg), ies->nas_pdu.buf, ies->nas_pdu.size);
@@ -524,6 +530,12 @@
}
}
+ if (ies->nas_pdu.size > msgb_tailroom(msg)) {
+ LOGPIU(LOGL_ERROR, "RANAP DirectTransfer: NAS-PDU size %d >
tailroom %d, dropping\n",
+ ies->nas_pdu.size, msgb_tailroom(msg));
+ msgb_free(msg);
+ return -1;
+ }
msgb_gmmh(msg) = msgb_put(msg, ies->nas_pdu.size);
memcpy(msgb_gmmh(msg), ies->nas_pdu.buf, ies->nas_pdu.size);
--
To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-iuh
Gerrit-Branch: master
Gerrit-Change-Id: I7dbce926477f9842cd466d46cda836638f04011f
Gerrit-Change-Number: 42887
Gerrit-PatchSet: 3
Gerrit-Owner: n0k0 <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <[email protected]>
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
