REDHAT-BUG-2489128: Buffer Overflow

A heap-based buffer overflow vulnerability was found in oFono's QMI modem network registration driver. The function scannetscb() in drivers/qmimodem/network-registration.c copies a network operator description from a QMI NAS NETWORKSCAN response TLV into the heap-allocated list[i].name buffer (char[64], OFONOMAXOPERATORNAMELENGTH + 1) using strncpy with netinfo->desclen as the length. Since netinfo->desclen is a uint8t field from the modem-controlled QMI TLV (range 0-255) and no bounds check is performed against the 64-byte buffer size, an attacker can supply a desclen value greater than 64.

Two overflows occur: (1) strncpy writes up to 255 bytes into the 64-byte name buffer (line 328), and (2) a NUL terminator is written at name[desclen] which can be up to 191 bytes past the buffer end (line 329). The list array is heap-allocated via lnew, so this corrupts adjacent heap objects.

The vulnerability can be triggered by a rogue USB QMI modem or compromised Qualcomm baseband firmware returning crafted NAS NETWORKSCAN responses with an oversized operator name. The scan is triggered when a user performs manual network selection, when NetworkManager/ConnMan auto-scans, or via the org.ofono.NetworkRegistration.Scan D-Bus method. Since ofonod runs as root with no sandbox, successful exploitation of the heap corruption could lead to arbitrary code execution with root privileges.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.