CVE-2023-4235

Name of the Vulnerable Software and Affected Versions ofono (affected versions not specified)

Description A flaw was found in ofono, an Open Source Telephony on Linux, where a stack overflow bug is triggered within the decode deliver report() function during SMS decoding. This issue is related to the parsing of SMS PDUs and can be exploited remotely without requiring authentication. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or via SMS. A bound check for the memcpy length was forgotten in decode deliver report(), unlike in decode submit().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.