laforge has submitted this change. (
https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email )
Change subject: ipaccess-proxy: reject oversized IPA frame length
......................................................................
ipaccess-proxy: reject oversized IPA frame length
ipaccess_proxy_read_msg() reads the 16-bit IPA frame length from the
wire header and passes it straight as the recv() count into a msgb that
was allocated with a fixed PROXY_ALLOC_SIZE (1200) bytes, without ever
checking it against the buffer tailroom. A peer that advertises a body
length larger than the remaining buffer space makes recv() write past
the end of the heap allocation (heap buffer overflow).
Reject frames whose advertised length exceeds the msgb tailroom, the
same way the other IPA read paths bound the read to msgb_tailroom().
This issue has been assigned the CVE candidate identifier
CAN-2026-2051036.
Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f
---
M src/ipaccess/ipaccess-proxy.c
1 file changed, 6 insertions(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
laforge: Looks good to me, approved
fixeria: Looks good to me, but someone else must approve
diff --git a/src/ipaccess/ipaccess-proxy.c b/src/ipaccess/ipaccess-proxy.c
index 61c2fc2..71190f6 100644
--- a/src/ipaccess/ipaccess-proxy.c
+++ b/src/ipaccess/ipaccess-proxy.c
@@ -583,6 +583,12 @@
/* then read the length as specified in header */
msg->l2h = msg->data + sizeof(*hh);
len = ntohs(hh->len);
+ if (len > msgb_tailroom(msg)) {
+ LOGP(DLINP, LOGL_ERROR, "Oversized IPA frame: len %d > tailroom
%d\n", len, msgb_tailroom(msg));
+ msgb_free(msg);
+ *error = -EIO;
+ return NULL;
+ }
ret = recv(bfd->fd, msg->l2h, len, 0);
if (ret < len) {
LOGP(DLINP, LOGL_ERROR, "short read!\n");
--
To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-bsc
Gerrit-Branch: master
Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f
Gerrit-Change-Number: 42886
Gerrit-PatchSet: 5
Gerrit-Owner: n0k0 <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <[email protected]>
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
