Log in Start free

Vulnerability · Published Apr 17, 2024 · Assigned by fedora

CVE-2023-4234Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_submit_report() function

High 8.1

In plain English

A high-severity memory corruption in Fedora from Fedora. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.1%top 33.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_submit_report().

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ofonono fix listedDEBIAN-CVE-2023-4234
Debian:13ofono2.10-1DEBIAN-CVE-2023-4234
Debian:14ofono2.10-1DEBIAN-CVE-2023-4234
Ubuntu:22.04:LTSofono1.31-3ubuntu1.1USN-7141-1
Ubuntu:22.04:LTSofono1.31-3ubuntu1.1UBUNTU-CVE-2023-4234
Ubuntu:24.04:LTSofono1.31-3ubuntu3.24.04.1USN-7141-1
Ubuntu:24.04:LTSofono1.31-3ubuntu3.24.04.1UBUNTU-CVE-2023-4234

Affected products (as reported)

VendorProductVersions
n/a ofono see references
Fedora Fedora see references

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References