CVE-2023-4235: falha de alta gravidade em ofono
Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_deliver_report() function
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.9%
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_deliver_report().
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVEs relacionadas — ofono
No mesmo produto, das mais perigosas para as menos.
CVE-2023-1183MEDIUMArbitrary file writeEPSS 64.9%CVE-2023-3338MEDIUMCrash due to a null pointer dereference in the dn_nsp_send functionEPSS 8.5%CVE-2023-6246HIGHGlibc: heap-based buffer overflow in __vsyslog_internal()EPSS 4.8%CVE-2023-32248HIGHTree connection null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2023-32252HIGHSession null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2023-32247HIGHSession setup memory exhaustion denial-of-service vulnerabilityEPSS 3.9%