PT-2023-9373 · Ofono+4 · Ofono+4
Sandipan Roy
·
Published
2023-05-10
·
Updated
2025-02-13
·
CVE-2023-4232
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ofono (affected versions not specified)
Description
A flaw was found in ofono, an Open Source Telephony on Linux, where a stack overflow bug is triggered within the
decode status report() function during SMS decoding. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for the memcpy length in decode submit(), but it was forgotten in decode status report(). This vulnerability may allow a remote attacker to access confidential data, disrupt its integrity, and cause a denial of service.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Ubuntu
Ofono