Out-of-Bounds Read in libosmocore IPA CCM Identity-Tag Parsers

Executive Summary

This vulnerability involves out-of-bounds reads in libosmocore through version 1.14.1. It affects the IPA CCM identity-tag parsers in src/gsm/ipa.c, where improper handling of TLV (Type-Length-Value) structures allows remote attackers to read sensitive information from memory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running libosmocore versions prior to 1.14.1. Check for out-of-bounds reads in IPA CCM identity-tag parsers by monitoring logs for malformed IPA protocol messages or crashes in GSM/IPA-related services. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to obtain sensitive data, such as memory contents, by sending malformed IPA CCM messages. This could lead to information disclosure or further exploitation depending on the system's context.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected libosmocore versions may face compliance risks due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade libosmocore to version 1.14.1 or later to address the out-of-bounds reads and truncation issues in IPA CCM parsers.
• Apply patches from the referenced commits (afd18bf, 8ba652b, 325ffb5) to fix the variable type and logging issues.
• Monitor network traffic for malformed IPA protocol messages that may exploit these vulnerabilities.

Useful 0 Not Useful 0