REDHAT-BUG-2489133: Buffer Overflow

A heap-based buffer overflow vulnerability was found in oFono's HDLC (High-Level Data Link Control) decoder. The newbytes() function in gatchat/gathdlc.c writes incoming serial data bytes into a heap-allocated decodebuffer of 4096 bytes (BUFFERSIZE = 2 2048) using a decodeoffset counter that is only reset to 0 when a HDLC flag byte (0x7E) is received. There is no bounds check comparing decodeoffset against BUFFERSIZE before writing to decodebuffer[decodeoffset++] at lines 288 and 309.

If a compromised modem sends more than 4096 bytes without a HDLC flag byte, decodeoffset increments past BUFFERSIZE and subsequent writes corrupt heap memory beyond the allocated buffer. This is a particularly powerful exploitation primitive because the attacker controls: (1) the write offset — determined by how many bytes are sent without a flag, which can be arbitrarily large, (2) the written value — each byte is the raw byte from the serial link or byte XOR 0x20 for escaped bytes, (3) the write granularity — byte-by-byte for precise heap corruption, and (4) the state persists across multiple newbytes() callback invocations.

The HDLC layer is used in two contexts: PPP data connections (when an AT modem establishes a data call via ATD99# or AT+CGDATA) and GSM 07.10 Advanced MUX mode. In both cases, a compromised baseband modem has direct control over the raw bytes on the serial link. Since ofonod runs as root with no sandbox, successful exploitation of the heap corruption could lead to arbitrary code execution with root privileges.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.