Oleksandr Bazhaniuk

An issue with improper restriction of operations within the bounds of a memory buffer was found. This issue may allow an attacker to access and control memory, potentially enabling remote code execution on the baseband radio processor of the Telematics Control Unit (TCU). The vulnerability is related to the temporary mobile subscriber identity (TMSI).

The issue is related to a buffer overflow in the `mipsnet receive` function, which can be triggered when the guest NIC is configured to accept large packets. This allows remote attackers to cause a denial of service, resulting in memory corruption and a crash of QEMU, or possibly execute arbitrary code via a packet larger than 1514 bytes.

The issue is related to a buffer overflow in the `stellaris enet receive` function, which can cause a denial of service (QEMU crash) when the Stellaris ethernet controller is configured to accept large packets. This can be triggered by remote attackers sending a large packet.