CVE-2023-4234: Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_submit_report() function

ofono is a Open Source Telephony on Linux stack overflow bug is triggered within the decodesubmitreport() function during SMS decoding here assumed that the attack scenario is accessible from a compromised modem or possibily accessible from a malicious base station or just SMS

there is a bound check for this memcpy length in decodesubmit(), but they forgot it in decodesubmitreport() this is a variant from ZDI-CAN-20971 partial code path is here - atcmtnotify() - ofonosmsdelivernotify() - smsdecode() - decodesubmitreport()

~~~C++

static gboolean decodesubmitreport(const unsigned char pdu, int len, struct sms out) { ... if (pi & 0x04) { int expected;

if (!nextoctet(pdu, len, &offset, &udl)) return FALSE;

expected = smsudlinbytes(udl, dcs);

if ((len - offset) < expected) return FALSE;

if (out->type == SMSTYPESUBMITREPORTERROR) { out->submiterrreport.udl = udl; memcpy(out->submiterrreport.ud, pdu + offset, expected); // overflow here, expected is from SMS PDU } else { out->submitackreport.udl = udl; memcpy(out->submitackreport.ud, pdu + offset, expected); } }

return TRUE; } ~~~

ASAN report ================================================================= ==118728==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd6df4c7bc at pc 0x7ff353a49846 bp 0x7ffd6df4c470 sp 0x7ffd6df4bc18 WRITE of size 240 at 0x7ffd6df4c7bc thread T0 #0 0x7ff353a49845 in interceptormemcpy ../../../../src/libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc:827 #1 0x5612928c6d77 in decodesubmitreport src/smsutil.c:946 #2 0x5612928cb479 in smsdecode src/smsutil.c:1569 #3 0x56129286708d in main src/main.c:225 #4 0x7ff35362350f in libcstartcallmain ../sysdeps/nptl/libcstartcallmain.h:58 #5 0x7ff3536235c8 in libcstartmainimpl ../csu/libc-start.c:381 #6 0x561292606274 in start (/root/ofono/src/ofonod+0x12b274)

Address 0x7ffd6df4c7bc is located in stack of thread T0 at offset 316 in frame #0 0x561292866edd in main src/main.c:205

This frame has 1 object(s): [48, 316) 'sms1' (line 212) <== Memory access at offset 316 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions are supported) SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc:827 in interceptormemcpy Shadow bytes around the buggy address: 0x10002dbe18a0: 01 f2 01 f2 04 f3 f3 f3 00 00 00 00 00 00 00 00 0x10002dbe18b0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f3 f3 f3 0x10002dbe18c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002dbe18d0: f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 0x10002dbe18e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x10002dbe18f0: 00 00 00 00 00 00 00[04]f3 f3 f3 f3 f3 f3 f3 f3 0x10002dbe1900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002dbe1910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002dbe1920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002dbe1930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002dbe1940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==118728==ABORTING

— Red Hat