PT-2023-7966 · Ofono+4 · Ofono+4

Sandipan Roy · Published 2023-05-10 · Updated 2025-08-07 · CVE-2023-4233

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ofono (affected versions not specified)

Description A flaw was found in ofono, an Open Source Telephony on Linux, where a stack overflow bug is triggered within the sms decode address field() function during the SMS PDU decoding. This issue can be exploited remotely, potentially allowing an attacker to execute arbitrary code. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or just SMS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

RCE

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-20

CWE-119

Related Identifiers

BDU:2023-09050

CVE-2023-4233

MGASA-2025-0063

USN-7141-1

ZDI-23-1859

Affected Products

Astra Linux

Debian

Linuxmint

Ubuntu

Ofono

References · 30

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-4233 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NBTPKR3LYTTLROPXF77FL4SPLXVHNC4T · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4233 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-4233 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-4233 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7141-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7151-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-4233 · Security Note
• https://bdu.fstec.ru/vul/2023-09050 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VG6FHQITWUNHBDGPXUQ77SZK5O5BYIBZ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4233 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-2794 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0063.html · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20241017SE16 · Vendor Advisory