Executive brief
osmo-ggsn is a GPRS gateway node that routes mobile data traffic between cellular networks and the internet. A memory corruption flaw in PDP context processing allows a malicious peer network node to crash the gateway or potentially execute code by sending specially crafted network messages.
Technical details
The gtp_decode_pdp_ctx() function in osmo-ggsn and osmo-sgsn's libgtp library fails to validate GSN-Address sub-field lengths against the 16-byte destination buffer before performing memcpy(), allowing lengths up to 255 bytes from the wire to overflow the fixed array. The vulnerability is exploitable over the Gn/Gp interface by a malicious or spoofed peer GSN through SGSN Context Response or Forward Relocation messages. A fix validating lengths against destination capacity is available.
Affected products
- osmocom osmo-ggsn 1.14.0
- osmocom osmo-sgsn <UNKNOWN>
Timeline
- 2026-09-18: disclosed
- 2026-08-12: patched: Fix committed to osmo-ggsn repository