REDHAT-BUG-2489130: Buffer Overflow

A stack-based buffer overflow vulnerability was found in oFono's AT modem Icera network time notification handler. The function tltsnotify() in drivers/atmodem/network-registration.c uses sscanf with an unbounded %s format specifier to parse a timezone string from the TLTS: unsolicited AT notification into a 4-byte stack buffer tz[4]. The buffer is sized for a normal timezone offset like "+08" (3 chars + null = 4 bytes), but sscanf with %s reads all non-whitespace characters without any width limit.

A compromised Icera modem baseband can send a TLTS: notification with an arbitrarily long timezone string (e.g., "24/01/15,12:30:45+BBBB...100chars..."), causing sscanf to write up to ~98 bytes past the end of the 4-byte tz buffer. This corrupts the stack frame including saved registers and the return address, leading to a crash or potentially arbitrary code execution. No user interaction is required — TLTS: is an unsolicited notification that the modem can send at any time after registration. Since ofonod runs as root with no sandbox, successful exploitation grants root-level code execution.

This vulnerability is similar to ZDI-CAN-30191 (huaweinwtimenotify) but affects the Icera TLTS: handler instead of the Huawei ^NWTIME: handler.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.