PT-2024-38407 · Ofono+3 · Ofono+3

Published 2024-08-05 · Updated 2026-04-16 · CVE-2024-7541

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions oFono (affected versions not specified)

Description This issue allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of responses from AT+CMT commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

CWE-457

Related Identifiers

CVE-2024-7541

USN-8178-1

ZDI-24-1081

Affected Products

Debian

Linuxmint

Ubuntu

Ofono

References · 26

• https://ubuntu.com/security/CVE-2024-7543 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7541 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-7541 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-7544 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-7541 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7541 · Security Note
• https://ubuntu.com/security/CVE-2024-7546 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-7542 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-7547 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-1081 · Security Note
• https://osv.dev/vulnerability/USN-8178-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-7541 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-7541 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-7541 · Security Note
• https://ubuntu.com/security/CVE-2024-7538 · Vendor Advisory