A heap-based buffer overflow vulnerability was found in oFono's HDLC (High-Level Data Link Control) decoder. The newbytes() function in gatchat/gathdlc.c writes incoming serial data bytes into a heap-allocated decodebuffer of 4096 bytes (BUFFERSIZE = 2 2048) using a decodeoffset counter that is only reset to 0 when a HDLC flag byte (0x7E) is received. There is no bounds check comparing decodeoffset against BUFFERSIZE before writing to decodebuffer[decodeoffset++] at lines 288 and 309.

If a compromised modem sends more than 4096 bytes without a HDLC flag byte, decodeoffset increments past BUFFERSIZE and subsequent writes corrupt heap memory beyond the allocated buffer. This is a particularly powerful exploitation primitive because the attacker controls: (1) the write offset — determined by how many bytes are sent without a flag, which can be arbitrarily large, (2) the written value — each byte is the raw byte from the serial link or byte XOR 0x20 for escaped bytes, (3) the write granularity — byte-by-byte for precise heap corruption, and (4) the state persists across multiple newbytes() callback invocations.

The HDLC layer is used in two contexts: PPP data connections (when an AT modem establishes a data call via ATD99# or AT+CGDATA) and GSM 07.10 Advanced MUX mode. In both cases, a compromised baseband modem has direct control over the raw bytes on the serial link. Since ofonod runs as root with no sandbox, successful exploitation of the heap corruption could lead to arbitrary code execution with root privileges.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.

A stack-based buffer overflow vulnerability was found in oFono's AT modem Icera network time notification handler. The function tltsnotify() in drivers/atmodem/network-registration.c uses sscanf with an unbounded %s format specifier to parse a timezone string from the TLTS: unsolicited AT notification into a 4-byte stack buffer tz[4]. The buffer is sized for a normal timezone offset like "+08" (3 chars + null = 4 bytes), but sscanf with %s reads all non-whitespace characters without any width limit.

A compromised Icera modem baseband can send a TLTS: notification with an arbitrarily long timezone string (e.g., "24/01/15,12:30:45+BBBB...100chars..."), causing sscanf to write up to ~98 bytes past the end of the 4-byte tz buffer. This corrupts the stack frame including saved registers and the return address, leading to a crash or potentially arbitrary code execution. No user interaction is required — TLTS: is an unsolicited notification that the modem can send at any time after registration. Since ofonod runs as root with no sandbox, successful exploitation grants root-level code execution.

This vulnerability is similar to ZDI-CAN-30191 (huaweinwtimenotify) but affects the Icera TLTS: handler instead of the Huawei ^NWTIME: handler.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.

A heap-based buffer overflow vulnerability was found in oFono's QMI modem network registration driver. The function scannetscb() in drivers/qmimodem/network-registration.c copies a network operator description from a QMI NAS NETWORKSCAN response TLV into the heap-allocated list[i].name buffer (char[64], OFONOMAXOPERATORNAMELENGTH + 1) using strncpy with netinfo->desclen as the length. Since netinfo->desclen is a uint8t field from the modem-controlled QMI TLV (range 0-255) and no bounds check is performed against the 64-byte buffer size, an attacker can supply a desclen value greater than 64.

Two overflows occur: (1) strncpy writes up to 255 bytes into the 64-byte name buffer (line 328), and (2) a NUL terminator is written at name[desclen] which can be up to 191 bytes past the buffer end (line 329). The list array is heap-allocated via lnew, so this corrupts adjacent heap objects.

The vulnerability can be triggered by a rogue USB QMI modem or compromised Qualcomm baseband firmware returning crafted NAS NETWORKSCAN responses with an oversized operator name. The scan is triggered when a user performs manual network selection, when NetworkManager/ConnMan auto-scans, or via the org.ofono.NetworkRegistration.Scan D-Bus method. Since ofonod runs as root with no sandbox, successful exploitation of the heap corruption could lead to arbitrary code execution with root privileges.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.

A stack-based buffer overflow vulnerability was found in oFono's AT modem USSD handling. The function cusdparse() in drivers/atmodem/ussd.c uses a bounds check (strlen > sizeof(msg) 2, i.e., strlen > 320) that is designed for the hex decode paths where 2 input hex characters produce 1 output byte. However, when the GSM 7-bit character set is used (ATUTILCHARSETGSM + SMSCHARSET7BIT), pack7bitownbuf() is called which packs each input character into 7/8 bytes of output. This means 320 input characters produce 280 bytes of output, overflowing the 160-byte stack buffer msg[160] by up to 120 bytes.

The correct limit for the GSM 7-bit pack path is 182 characters (182 7/8 = 159 bytes). Both the UTF-8 path (ussdencode) and UCS2 path (ucs2gsmtopacked) correctly check for this limit, but the GSM path is missing the check.

A compromised modem baseband can trigger this by sending an unsolicited +CUSD notification with a long payload (e.g., 300 characters) after the modem reports GSM charset via AT+CSCS?. The overflow corrupts the stack frame including saved registers and the return address, leading to a crash or potentially arbitrary code execution. Since ofonod runs as root with no sandbox, successful exploitation grants root-level code execution. No user interaction is required — the +CUSD notification is unsolicited and processed automatically.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.

This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-7539.

This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-7539.

oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23309.

This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

oFono AT CMT Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of responses from AT+CMT commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23308.

oFono CUSD Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of responses from AT+CUSD commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23195.

oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23456.

oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of SMS message lists. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23157.

oFono CUSD AT Command Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of responses from AT Commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23190.

oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23307.

oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23458.

oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23460.

oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23457.

oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23459.

This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.

This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMT commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.

This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.

This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMT commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.

This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SMS message lists. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SMS message lists. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CUSD commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CUSD commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.