PT-2023-9157 · Ofono+4 · Ofono+4

Sandipan Roy · Published 2023-05-10 · Updated 2025-08-07 · CVE-2023-4235

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ofono (affected versions not specified)

Description A flaw was found in ofono, an Open Source Telephony on Linux, where a stack overflow bug is triggered within the decode deliver report() function during SMS decoding. This issue is related to the parsing of SMS PDUs and can be exploited remotely without requiring authentication. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or via SMS. A bound check for the memcpy length was forgotten in decode deliver report(), unlike in decode submit().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2024-04254

CVE-2023-4235

MGASA-2025-0063

USN-7151-1

ZDI-24-013

Affected Products

Astra Linux

Debian

Linuxmint

Ubuntu

Ofono

References · 23

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=2255402 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4235 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-4235 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-4235 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-4235 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-4235 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04254 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-013 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4235 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7151-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/RLAWJAAS3HDI2KMCZXF4DMR3Y4BQNMKO · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0063.html · Security Note
• https://osv.dev/vulnerability/USN-7151-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7141-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4235 · Security Note