Log in Start free

Vulnerability · Published Apr 17, 2024 · Assigned by fedora

CVE-2023-4235Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_deliver_report() function

High 8.1

In plain English

A high-severity memory corruption in Fedora from Fedora. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.9%top 38.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_deliver_report().

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ofonono fix listedDEBIAN-CVE-2023-4235
Debian:13ofono2.14-1DEBIAN-CVE-2023-4235
Debian:14ofono2.14-1DEBIAN-CVE-2023-4235
Ubuntu:22.04:LTSofono1.31-3ubuntu1.2USN-7151-1
Ubuntu:22.04:LTSofono1.31-3ubuntu1.2UBUNTU-CVE-2023-4235
Ubuntu:24.04:LTSofono1.31-3ubuntu3.24.04.2UBUNTU-CVE-2023-4235
Ubuntu:24.04:LTSofono1.31-3ubuntu3.24.04.2USN-7151-1
Ubuntu:25.10ofonono fix listedUBUNTU-CVE-2023-4235
Ubuntu:26.04:LTSofonono fix listedUBUNTU-CVE-2023-4235
Ubuntu:26.10ofonono fix listedUBUNTU-CVE-2023-4235

Affected products (as reported)

VendorProductVersions
n/a ofono see references
Fedora Fedora see references

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References