laforge has submitted this change. (
https://gerrit.osmocom.org/c/osmo-ggsn/+/42885?usp=email )
(
3 is the latest approved patch-set.
No files were changed between the latest approved patch-set and the submitted
one.
)Change subject: gtp: fix OOB write in PDP ctx GSN-Address decode
......................................................................
gtp: fix OOB write in PDP ctx GSN-Address decode
gtp_decode_pdp_ctx() takes the GSN-Address sub-field lengths of a PDP
Context IE (gsnrc / gsnru, the GGSN control- and user-plane addresses)
straight from the wire and memcpy()s that many bytes into the fixed
16-byte 'struct ul16_t' v[] array, with no check against the destination
size. decode_pdp_ctx_len_check() only validates the declared lengths
against the *input* buffer, never against the destination capacity, so a
wire length of 17..255 overflows the 16-byte field by up to 239 bytes,
clobbering adjacent struct pdp_t state.
The PDP Context IE is carried in SGSN Context Response / Forward
Relocation messages exchanged between peer GSNs over Gn/Gp, so a
malicious or spoofed peer GSN can trigger this. The same libgtp decoder
is linked by osmo-sgsn, so it is affected as well.
A GSN address is 4 (IPv4) or 16 (IPv6) bytes, so reject any length that
does not fit the destination before copying.
This issue has been assigned the CVE candidate identifier
CAN-2026-2051035.
Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98
---
M gtp/gtp.c
1 file changed, 12 insertions(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
pespin: Looks good to me, but someone else must approve
fixeria: Looks good to me, approved
diff --git a/gtp/gtp.c b/gtp/gtp.c
index 7a439d9..f378c17 100644
--- a/gtp/gtp.c
+++ b/gtp/gtp.c
@@ -1245,12 +1245,24 @@
/* GGSN Address Ctrl */
pdp->gsnrc.l = *ptr;
ptr++;
+ if (pdp->gsnrc.l > sizeof(pdp->gsnrc.v)) {
+ LOGP(DLGTP, LOGL_ERROR,
+ "PDP Context Decode: GSN Address (Ctrl) length %u
exceeds %zu\n",
+ pdp->gsnrc.l, sizeof(pdp->gsnrc.v));
+ return -EINVAL;
+ }
memcpy(pdp->gsnrc.v, ptr, pdp->gsnrc.l);
ptr += pdp->gsnrc.l;
/* GGSN Address User */
pdp->gsnru.l = *ptr;
ptr++;
+ if (pdp->gsnru.l > sizeof(pdp->gsnru.v)) {
+ LOGP(DLGTP, LOGL_ERROR,
+ "PDP Context Decode: GSN Address (User) length %u
exceeds %zu\n",
+ pdp->gsnru.l, sizeof(pdp->gsnru.v));
+ return -EINVAL;
+ }
memcpy(pdp->gsnru.v, ptr, pdp->gsnru.l);
ptr += pdp->gsnru.l;
--
To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/42885?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-ggsn
Gerrit-Branch: master
Gerrit-Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98
Gerrit-Change-Number: 42885
Gerrit-PatchSet: 4
Gerrit-Owner: n0k0 <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <[email protected]>
Gerrit-Reviewer: fixeria <[email protected]>
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
