Hello Jenkins Builder,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/osmo-sgsn/+/43323?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Verified+1 by Jenkins Builder
Change subject: ranap: reject oversized RANAP NAS-PDU
......................................................................
ranap: reject oversized RANAP NAS-PDU
The connection-oriented RANAP handlers ranap_handle_co_initial_ue() and
ranap_handle_co_dt() copy the attacker-controlled NAS-PDU into a msgb
allocated with a fixed 256 bytes. RANAP NAS-PDU is an unconstrained
OCTET STRING, so the APER decoder accepts an arbitrarily large PDU; when
nas_pdu.size exceeds the msgb tailroom, msgb_put() hits MSGB_ABORT and
osmo_panic()s the process (MSGB_DEBUG is compiled in unconditionally),
which a femtocell (HNB) peer can use to crash osmo-hnbgw / osmo-hnodeb
by sending an InitialUE or DirectTransfer with a NAS-PDU > 256 bytes.
Validate nas_pdu.size against the msgb tailroom and drop the message
gracefully instead of panicking.
This issue has been assigned the CVE candidate identifier
CAN-2026-2051037.
This is a backport from osmo-iuh.git f06967126f486bcb185ccf3d1a8f9bc02c4da1f6
Change-Id: I2090c7acbf861dfc295a82ef32a976ea7742438b
---
M src/sgsn/gprs_ranap.c
1 file changed, 14 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/23/43323/2
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43323?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I2090c7acbf861dfc295a82ef32a976ea7742438b
Gerrit-Change-Number: 43323
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <[email protected]>
Gerrit-Reviewer: Jenkins Builder
