ASN1C preprocessor bug - does this affect the GSM Pyra?


levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
14,572
Location
Somewhere off the coast of the EU
See https://github.com/programa-stic/security-advisories/tree/master/ObjSys/CVE-2016-5080

The Pyra's GSM chip presumably runs some sort of OS to parse AT commands and deal with real-time parts of phone connectivity. If the source for that OS was built using a preprocessor named ASN1C to boilerplate up some of the code to talk some of the primitive protocols that GSM protocols require, then it'll be built including a lib that contains an integer overflow that results in a buffer overflow.

Do you have the source for that component? As far as I can tell, windows builds will include 'asn1rt_a.lib' and presumably something similarly named will be included for linux builds if ASN1C has been used - you might even be able to find that in a binary blob, if you can get that.

If the Pyra is affected, the Linux OS should be mostly immune since the chip OS can only talk to Linux through AT commands and responses, but it's feasible this overflow could make the chip call premium rate numbers without you being aware, for example.
 

levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
14,572
Location
Somewhere off the coast of the EU
There will be. The company that makes the preprocessor has released a patch to any customer who asks for it, and will release it to all customers in due course with the next release anyway. Then it just needs the people that make the chip to regenerate their source and build it, and send it to Nikolaus or ED as a binary blob (I assume).

I made this thread just so ED and/or Nikolaus are aware. And in case there's any discussion about it needed - for example this bug has been found through disassembling an x86 Windows build - I'm pretty sure that chip isn't running Windows, even an embedded version, and probably on an ARM or MIPS core, so perhaps the source when built doesn't express the same bug on that platform.
 
Top