Out-of-Bounds Read in libosmocore CBSP Decoder

Executive Summary

This vulnerability is an out-of-bounds read in the CBSP WRITE-REPLACE decoder of libosmocore through version 1.14.1. The issue occurs in the function cbsp_dec_write_repl() where an 8-bit page count from a network packet is used to index an array of 16 entries. If the page count exceeds 16, it can cause a heap overflow leading to potential stack corruption.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running libosmocore versions before 1.14.1. Check for crashes or memory corruption in CBSP-related processes. Monitor network traffic for malformed CBSP packets triggering the OOB read. Use tools like gdb to analyze core dumps from affected services.

Useful 0 Not Useful 0

Impact Analysis

A remote attacker could exploit this flaw to cause a denial of service by triggering an out-of-bounds read, potentially crashing the affected system or service using the libosmocore library.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade libosmocore to version 1.14.1 or later. Apply the patch from the provided commit (1659b5874223934d5586e3e96b7d59f653c90ea6) to add bounds checking in the CBSP decoder. Restart affected services after updating to ensure the fix is active.

Useful 0 Not Useful 0