CVE-2024-7547: (0Day) oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability
oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23460.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7547?
CVE-2024-7547 has been assigned a high severity rating due to its ability to allow local privilege escalation and arbitrary code execution.
How do I fix CVE-2024-7547?
To fix CVE-2024-7547, update to the latest version of oFono that addresses this vulnerability.
Who is affected by CVE-2024-7547?
CVE-2024-7547 affects local users of oFono version 2.3 who can execute code on the target modem.
What type of attack is associated with CVE-2024-7547?
CVE-2024-7547 is associated with a stack-based buffer overflow vulnerability that can be exploited by attackers with local access.
What are the potential consequences of exploiting CVE-2024-7547?
Exploiting CVE-2024-7547 may lead to arbitrary code execution, allowing attackers to gain elevated privileges on the affected system.