Most recent entries from all

CVE-2024-7538 — oFono CUSD AT Command Stack-based Buffer Overflow Code Execution Vulnerability

Affected: oFono

oFono CUSD AT Command Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of responses from AT Commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23190.

USN-8178-1 — ofono vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: ofono, Ubuntu:Pro:18.04:LTS: ofono, Ubuntu:Pro:20.04:LTS: ofono, Ubuntu:Pro:22.04:LTS: ofono, Ubuntu:Pro:24.04:LTS: ofono

It was discovered that oFono incorrectly handled crafted responses from AT commands. An attacker could possibly use this issue to crash the program, resulting in a denial of service or arbitrary code execution. (CVE-2024-7538, CVE-2024-7539, CVE-2024-7540, CVE-2024-7541, CVE-2024-7542)

Lucas Leong discovered that oFono incorrectly handled crafted input. An attacker could possibly use this issue to crash the program, resulting in a denial of service or arbitrary code execution. (CVE-2024-7543, CVE-2024-7544, CVE-2024-7545, CVE-2024-7546, CVE-2024-7547)