CVE-2024-22123

What it actually does

An authenticated administrator can configure an arbitrary file path as the GSM modem device, causing the server process to treat the path as a Linux device file, write AT modem commands into it, corrupt its contents, and return a portion of the file back through the user interface.

Why it matters to the business

Administrative users can corrupt log files or other important files on the server and obtain limited leakage of their contents, resulting in data integrity problems and minor information disclosure with low overall operational disruption.

How an attack unfolds

An attacker with administrative privileges configures the SMS media type to point at a chosen target file such as a log instead of a real modem device; when the server attempts initialization it writes AT commands into the file and surfaces a fragment of its content in the UI, enabling tampering and limited data exposure.

How to fix it

Apply the listed fixed package versions for all affected AlmaLinux 8 modules and verify that SMS media configurations only reference legitimate modem device paths.

How to confirm the fix worked

Confirm the updated package versions are installed, review all SMS media type definitions to ensure only valid device files are referenced, and test that arbitrary file paths are rejected.

Typical attack path

1. Obtain administrative access to the monitoring console
2. Navigate to media type configuration for SMS
3. Supply an arbitrary file path as the GSM modem device
4. Trigger modem communication to corrupt the file and retrieve leaked content

How to detect it

Search server logs and configuration history for SMS media entries containing non-standard device paths, and inspect files for unexpected blocks of AT command text.

What your security team should do

• Immediately apply the supplied fixed package versions
• Audit existing SMS media configurations for non-modem paths
• Restrict administrative access to media type settings
• Monitor for unexpected writes of AT command strings to log files