CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
48.5%
A flaw was found in ofono, an Open Source Telephony on Linux. A stack
overflow bug is triggered within the decode_deliver_report() function
during the SMS decoding. It is assumed that the attack scenario is
accessible from a compromised modem, a malicious base station, or just SMS.
There is a bound check for this memcpy length in decode_submit(), but it
was forgotten in decode_deliver_report().
Author | Note |
---|---|
sbeattie | Fedora seems to think that this was fixed in ofono 2.5; however, while that release does seem to add some additional bounds checks, the specific function referenced has not been touched since 2010. It’s not clear if or how this was fixed upstream. |
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
48.5%