CVE-2023-2794

What it actually does

Stack-based buffer overflow in decode_deliver() caused by unbounded memcpy of attacker-controlled SMS data, enabling memory corruption that can lead to code execution or denial of service.

Why it matters to the business

Systems running ofono for telephony on Linux face risk of remote compromise or service disruption through malicious SMS or base station interaction, potentially affecting mobile connectivity services and downstream dependent packages.

How an attack unfolds

An attacker delivers a specially crafted SMS or emulates a malicious base station that reaches ofono; the decode_deliver() path lacks the length check present in decode_submit(), overflowing the stack buffer and allowing control-flow hijacking.

How to fix it

Upgrade ofono to the fixed commit 07e13a47f99856004c1c3dc7d53b99f48bf626bd or later; rebuild and redeploy packages that depend on the updated library.

How to confirm the fix worked

Confirm the running ofono binary or source contains commit 07e13a47f99856004c1c3dc7d53b99f48bf626bd; test with crafted SMS payloads that previously triggered the overflow to verify absence of crash or corruption.

Typical attack path

1. Attacker obtains access via compromised modem, rogue base station, or direct SMS delivery
2. Malformed SMS PDU is received and passed to ofono's SMS decoder
3. decode_deliver() performs unbounded memcpy into stack buffer
4. Stack overflow corrupts return address or adjacent data
5. Attacker gains arbitrary code execution or crashes the process

How to detect it

Review system and application logs for ofono crashes or stack overflow indicators around SMS processing; correlate with unusual base station or modem activity.

• decode_deliver
• ofono.*SMS.*crash
• memcpy.*deliver

What your security team should do

• Apply the fixed commit immediately on all systems using ofono
• Monitor for abnormal ofono process crashes or restarts
• Restrict exposure of telephony interfaces where feasible until patched