CVE-2023-4232

What it actually does

Stack-based buffer overflow triggered in decode_status_report() during SMS decoding due to missing bound check on memcpy length, enabling memory corruption from oversized input.

Why it matters to the business

Enables remote compromise of Linux telephony systems handling mobile connectivity, risking device takeover, service outages, or data exposure on affected deployments.

How an attack unfolds

An attacker delivers a crafted SMS status report (via malicious base station, compromised modem, or direct SMS) that reaches decode_status_report(); the missing length validation allows an oversized memcpy to overflow the stack and potentially hijack control flow.

How to fix it

Update ofono to the version containing commit 54aa82cbbe3e3bf29dea7eaf35adbc91b94df2ae or later; rebuild and redeploy any packages depending on the affected ofono source.

How to confirm the fix worked

Confirm the fixed commit is present in the ofono source tree, verify the decode_status_report() function now contains an equivalent length check to decode_submit(), and test with crafted SMS inputs under controlled conditions.

Typical attack path

1. Deliver malicious SMS status report to target device
2. Trigger SMS decoding path invoking decode_status_report()
3. Exploit missing bound check to overflow stack buffer
4. Achieve memory corruption for code execution or denial of service

How to detect it

Inspect ofono process logs and core dumps for stack overflows during SMS status-report handling; correlate with inbound SMS events from untrusted sources.

What your security team should do

• Apply the upstream fix to all ofono deployments without delay
• Harden SMS ingress paths where feasible (e.g., network-level filtering)
• Monitor for ofono process crashes correlated with SMS activity
• Review downstream dependents and rebuild with the patched version