CVE-2023-4234

What it actually does

Stack-based buffer overflow in decode_submit_report() due to missing length check before memcpy during SMS decoding, allowing uncontrolled data copy onto the stack.

Why it matters to the business

Systems relying on ofono for mobile telephony face risk of crashes or remote code execution from SMS or modem-level attacks, potentially disrupting voice, messaging, and cellular connectivity services.

How an attack unfolds

An attacker with access via a compromised modem, malicious base station, or direct SMS delivery crafts a submit report PDU with an oversized payload. The decode_submit_report() function performs an unchecked memcpy, overflowing the stack and enabling control-flow hijacking or denial of service.

How to fix it

Upgrade ofono to commit 54aa82cbbe3e3bf29dea7eaf35adbc91b94df2ae or later. Rebuild and redeploy packages using the updated source. Until patched, restrict exposure of telephony interfaces to untrusted networks or modems where feasible.

How to confirm the fix worked

Confirm the running ofono binary or source tree contains commit 54aa82cbbe3e3bf29dea7eaf35adbc91b94df2ae. Exercise SMS decoding paths with boundary-test PDUs to verify absence of overflow. Monitor for segmentation faults in ofono processes after upgrade.

Typical attack path

1. Obtain path to deliver malicious SMS or control a modem/base station
2. Transmit crafted submit-report PDU exceeding expected bounds
3. Trigger decode_submit_report() which omits the length validation present in decode_submit()
4. Execute memcpy that overflows the stack buffer
5. Achieve crash, arbitrary code execution, or further privilege escalation on the host

How to detect it

Review ofono process logs and system crash reports for segmentation faults or stack-smashing indicators during SMS handling. Correlate unexpected ofono restarts with incoming SMS or modem events. Examine audit logs for unusual telephony daemon behavior around the time of suspected attacks.

What your security team should do

• Immediately upgrade all ofono installations to the fixed commit 54aa82cbbe3e3bf29dea7eaf35adbc91b94df2ae
• Inventory devices and services that embed or depend on ofono and prioritize patching by exposure level
• Implement network segmentation or modem filtering to limit untrusted SMS and base-station traffic until patches are applied
• Add ofono process crash and abnormal memory access alerts to existing monitoring