Buffer Overflow in libosmocore Affecting IuUP Protocol

Executive Summary

This vulnerability is a stack buffer overflow in the libosmocore library affecting the IuUP protocol implementation. The issue occurs in the function osmo_iuup_compute_payload_crc() when processing IuUP payloads larger than 1024 bytes during CRC verification. A fixed-size buffer of 1024 bytes is used without validating payload size, allowing writes beyond buffer limits and causing a stack overflow.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or abnormal behavior in applications using libosmocore, particularly those handling IuUP protocol traffic. Check logs for segmentation faults or stack overflow errors in services like OsmoBTS, OsmoMSC, or OsmoSGSN. Use network traffic analysis tools like Wireshark to inspect IuUP payload sizes exceeding 1024 bytes.

Useful 0 Not Useful 0

Impact Analysis

A remote attacker could exploit this to cause a denial of service by sending maliciously crafted IuUP payloads. This may crash the affected system or service using libosmocore, disrupting normal operations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libosmocore to a patched version (1.14.1 or later). If updating is not possible, restrict network access to systems using IuUP protocol or implement deep packet inspection to block oversized payloads. Monitor affected services for crashes and apply temporary workarounds like reducing payload sizes.

Useful 0 Not Useful 0