Executive brief
osmo-bsc is a base station controller for 2G mobile networks. An attacker can send specially crafted IPA protocol frames with oversized length values to trigger a heap buffer overflow in the proxy component, potentially allowing remote code execution or denial of service.
Technical details
A heap buffer overflow exists in the ipaccess_proxy_read_msg() function due to insufficient validation of IPA frame length fields. The function reads a 16-bit length value from the wire header and uses it directly in recv() without checking against the fixed 1200-byte msgb allocation, allowing an attacker to write past the heap buffer boundary via network-sourced frames.
Affected products
- Osmocom osmo-bsc 1.0.1 through 1.14.1
Timeline
- 2026-09-18: disclosed
- 2026-08-07: patched: Fix committed to master branch