Executive brief
osmo-iuh is a library that implements the Iuh interface protocol used in cellular networks for femtocell connectivity. A remote attacker connected as a femtocell peer can crash the gateway software by sending a specially crafted message with an oversized payload, causing a denial of service and potential outage of femtocell services.
Technical details
The ranap_handle_co_dt() and ranap_handle_co_initial_ue() functions in osmo-iuh copy attacker-controlled NAS-PDU data into a fixed 256-byte message buffer without validating the input size. When a NAS-PDU larger than 256 bytes is received, the msgb_put() call triggers an assertion that crashes the process. An unauthenticated network peer (femtocell) can exploit this to remotely crash osmo-hnbgw or osmo-hnodeb.
Affected products
- Osmocom osmo-iuh 0.1.0 through 1.8.0
Timeline
- 2026-09-18: disclosed