CVE-2024-7543: (0Day) oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability
oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23456.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7543?
CVE-2024-7543 has been classified with a high severity due to the potential for privilege escalation and arbitrary code execution.
How do I fix CVE-2024-7543?
To fix CVE-2024-7543, it is recommended to update oFono to the latest version that addresses this vulnerability.
Who is affected by CVE-2024-7543?
CVE-2024-7543 affects users of oFono version 2.3 installed on modems.
What is the impact of CVE-2024-7543?
The impact of CVE-2024-7543 is that it allows local attackers to execute arbitrary code on affected oFono installations.
Can CVE-2024-7543 be exploited remotely?
CVE-2024-7543 cannot be exploited remotely as an attacker must first gain access to execute code on the target modem.