From ee761d009dda7f817954f74ddedcd59b729a9598 Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Wed, 16 Sep 2026 18:09:59 -0500 Subject: [PATCH] CVE-2026-95622: cbm: don't assert handling unsupported encodings (8-bit and reserved) A cell broadcast message using unsupported encodings would trigger an assert in ModemManager and kill the process. A compromised base station or modem firmware could craft or pass through these messages. Reported by Yehia Ezzat and Keith Linneman Impact: Moderate CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5 Medium) CWE-617 (Reachable Assertion) Signed-off-by: Dan Williams --- src/mm-cbm-part.c | 4 ++- src/tests/test-cbm-part.c | 51 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 1 deletion(-) diff --git a/src/mm-cbm-part.c b/src/mm-cbm-part.c index 4b8a779d..86934235 100644 --- a/src/mm-cbm-part.c +++ b/src/mm-cbm-part.c @@ -225,7 +225,9 @@ mm_cbm_part_new_from_binary_pdu (const guint8 *pdu, cbm_part->encoding = MM_SMS_ENCODING_GSM7; else if (charset == CBS_DATA_CODING_GENERAL_UCS2) cbm_part->encoding = MM_SMS_ENCODING_UCS2; - } else { + } + + if (cbm_part->encoding == MM_SMS_ENCODING_UNKNOWN) { g_set_error (error, MM_CORE_ERROR, MM_CORE_ERROR_FAILED, diff --git a/src/tests/test-cbm-part.c b/src/tests/test-cbm-part.c index 5cb70ad4..6e5a9e76 100644 --- a/src/tests/test-cbm-part.c +++ b/src/tests/test-cbm-part.c @@ -161,6 +161,54 @@ test_cbm_eu (void) g_assert_cmpstr (mm_cbm_part_get_language (part), ==, "en"); } +static void +test_cbm_unhandled_data_coding_group_general_charset_reserved (void) +{ + g_autoptr(GError) err = NULL; + g_autoptr(MMCbmPart) part = NULL; + + static const guint8 pdu [] = { + 0x63, 0x40, 0x00, 0x32, 0x5C, 0x14, + 0x00, 0x20, 0x04, 0x1f, 0x04, 0x40, 0x04, 0x3e, + 0x04, 0x42, 0x04, 0x4f, 0x04, 0x33, 0x04, 0x3e, + 0x04, 0x3c, 0x00, 0x20, 0x04, 0x34, 0x04, 0x3d, + 0x04, 0x4f, 0x00, 0x20, 0x04, 0x54, 0x00, 0x20, + 0x04, 0x32, 0x04, 0x38, 0x04, 0x41, 0x04, 0x3e, + 0x04, 0x3a, 0x04, 0x30, 0x00, 0x20, 0x04, 0x56, + 0x04, 0x3c, 0x04, 0x3e, 0x04, 0x32, 0x04, 0x56, + 0x04, 0x40, 0x04, 0x3d, 0x04, 0x56, 0x04, 0x41, + 0x04, 0x42, 0x04, 0x4c, 0x00, 0x20, 0x04, 0x40, + 0x04, 0x30, 0x04, 0x3a, 0x04, 0x35, 0x04, 0x42, + 0x04, 0x3d, 0x16, 0x01, 0x00, 0x00}; + + part = mm_cbm_part_new_from_binary_pdu (pdu, G_N_ELEMENTS (pdu), NULL, &err); + g_assert_error (err, MM_CORE_ERROR, MM_CORE_ERROR_FAILED); +} + +static void +test_cbm_unhandled_data_coding_group_general_charset_8bit (void) +{ + g_autoptr(GError) err = NULL; + g_autoptr(MMCbmPart) part = NULL; + + static const guint8 pdu [] = { + 0x63, 0x40, 0x00, 0x32, 0x54, 0x14, + 0x00, 0x20, 0x04, 0x1f, 0x04, 0x40, 0x04, 0x3e, + 0x04, 0x42, 0x04, 0x4f, 0x04, 0x33, 0x04, 0x3e, + 0x04, 0x3c, 0x00, 0x20, 0x04, 0x34, 0x04, 0x3d, + 0x04, 0x4f, 0x00, 0x20, 0x04, 0x54, 0x00, 0x20, + 0x04, 0x32, 0x04, 0x38, 0x04, 0x41, 0x04, 0x3e, + 0x04, 0x3a, 0x04, 0x30, 0x00, 0x20, 0x04, 0x56, + 0x04, 0x3c, 0x04, 0x3e, 0x04, 0x32, 0x04, 0x56, + 0x04, 0x40, 0x04, 0x3d, 0x04, 0x56, 0x04, 0x41, + 0x04, 0x42, 0x04, 0x4c, 0x00, 0x20, 0x04, 0x40, + 0x04, 0x30, 0x04, 0x3a, 0x04, 0x35, 0x04, 0x42, + 0x04, 0x3d, 0x16, 0x01, 0x00, 0x00}; + + part = mm_cbm_part_new_from_binary_pdu (pdu, G_N_ELEMENTS (pdu), NULL, &err); + g_assert_error (err, MM_CORE_ERROR, MM_CORE_ERROR_FAILED); +} + static void parse_cbm (const char *str, MMCbmPart **part) { @@ -328,6 +376,9 @@ int main (int argc, char **argv) g_test_add_func ("/MM/CBM/PDU-Parser/has-7bit-lang", test_cbm_ucs2_with_7bit_lang); /* UCS2 message with additional padding: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/253#note_3355339 */ g_test_add_func ("/MM/CBM/PDU-Parser/UCS2/pad", test_cbm_ucs2_pad); + /* Ensure unhandled encodings don't trigger asserts */ + g_test_add_func ("/MM/CBM/PDU-Parser/8bit/error", test_cbm_unhandled_data_coding_group_general_charset_8bit); + g_test_add_func ("/MM/CBM/PDU-Parser/reserved/error", test_cbm_unhandled_data_coding_group_general_charset_reserved); return g_test_run (); }