CVE-2023-4234
published 2024-04-17CVE-2023-4234: A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS…
PriorityP349high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
1.15%
63.6th percentile
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_submit_report().
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ofono | < ofono 2.10-1 (forky) | ofono 2.10-1 (forky) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | >= 3.9.0 < 4.14.312 | 4.14.312 |
| linux | linux_kernel | >= 4.15.0 < 4.19.280 | 4.19.280 |
| linux | linux_kernel | >= 4.20.0 < 5.4.240 | 5.4.240 |
| linux | linux_kernel | >= 5.11.0 < 5.15.106 | 5.15.106 |
| linux | linux_kernel | >= 5.16.0 < 6.1.23 | 6.1.23 |
| linux | linux_kernel | >= 5.5.0 < 5.10.177 | 5.10.177 |
| linux | linux_kernel | >= 6.2.0 < 6.2.10 | 6.2.10 |
| ofono_project | ofono | < 2.1 | 2.1 |
| ofono_project | ofono | >= 0 < 2.10-1 | 2.10-1 |
| ofono_project | ofono | >= 0 < 2.10-1 | 2.10-1 |
| ofono_project | ofono | >= 0 < 1.31-3ubuntu1.1 | 1.31-3ubuntu1.1 |
| ofono_project | ofono | >= 0 < 1.31-3ubuntu3.24.04.1 | 1.31-3ubuntu3.24.04.1 |
| ofono_project | ofono | >= 0 < 1.17.bzr6912+16.04.20160314.3-0ubuntu1+esm1 | 1.17.bzr6912+16.04.20160314.3-0ubuntu1+esm1 |
| ofono_project | ofono | >= 0 < 1.21-1ubuntu1+esm1 | 1.21-1ubuntu1+esm1 |
| ofono_project | ofono | >= 0 < 1.31-2ubuntu1+esm1 | 1.31-2ubuntu1+esm1 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
osv8.1HIGH
vendor_debian8.1HIGH
vendor_ubuntu8.1HIGH
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
osv·2025-12-09
CVE-2023-53788 ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
tuning_ctl_set() might have buffer overrun at (X) if it didn't break
from loop by matching (A).
static int tuning_ctl_set(...)
{
for (i = 0; i < TUNING_CTLS_COUNT; i++)
(A) if (nid == ca0132_tuning_ctls[i].nid)
break;
snd_hda_power_up(...);
(X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...);
snd_hda_power_down(...); ^
return 1;
}
We will get below error by cppcheck
sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12
for (i = 0; i < TUNING_CTLS_COUNT; i++)
^
sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds
dspio_set_param(codec, ca0132_tuning_ctls[i].m
OSV
ofono vulnerabilities
osv·2024-12-09·CVSS 8.1
CVE-2023-2794 [HIGH] ofono vulnerabilities
ofono vulnerabilities
It was discovered that oFono incorrectly handled decoding SMS messages
leading to a stack overflow. A remote attacker could potentially use
this issue to cause a denial of service.
(CVE-2023-2794, CVE-2023-4233, CVE-2023-4234)
GHSA
GHSA-rc4x-jw53-834q: A flaw was found in ofono, an Open Source Telephony on Linux
ghsa_unreviewed·2024-04-18
CVE-2023-4234 [HIGH] CWE-119 GHSA-rc4x-jw53-834q: A flaw was found in ofono, an Open Source Telephony on Linux
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_submit_report().
OSV
CVE-2023-4234: A flaw was found in ofono, an Open Source Telephony on Linux
osv·2024-04-17·CVSS 8.1
CVE-2023-4234 [HIGH] CVE-2023-4234: A flaw was found in ofono, an Open Source Telephony on Linux
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_submit_report().
Red Hat
kernel: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
vendor_redhat·2025-12-09·CVSS 6.1
CVE-2023-53788 [MEDIUM] CWE-129 kernel: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
kernel: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
tuning_ctl_set() might have buffer overrun at (X) if it didn't break
from loop by matching (A).
static int tuning_ctl_set(...)
{
for (i = 0; i < TUNING_CTLS_COUNT; i++)
(A)if (nid == ca0132_tuning_ctls[i].nid)
break;
snd_hda_power_up(...);
(X)dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...);
snd_hda_power_down(...); ^
return 1;
}
We will get below error by cppcheck
sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12
for (i = 0; i < TUNING_CTLS_COUNT; i++)
^
sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds
dspio_set_param(codec, ca0132_tuning_ctls[i].mi
Ubuntu
oFono vulnerabilities
vendor_ubuntu·2024-12-09·CVSS 8.1
CVE-2023-4233 [HIGH] oFono vulnerabilities
Title: oFono vulnerabilities
Summary: Several security issues were fixed in oFono.
It was discovered that oFono incorrectly handled decoding SMS messages
leading to a stack overflow. A remote attacker could potentially use
this issue to cause a denial of service.
(CVE-2023-2794, CVE-2023-4233, CVE-2023-4234)
Instructions: After a standard system update you need to restart oFono to make
all the necessary changes.
Debian
CVE-2023-4234: ofono - A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow b...
vendor_debian·2023·CVSS 8.1
CVE-2023-4234 [HIGH] CVE-2023-4234: ofono - A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow b...
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_submit_report().
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.10-1)
sid: resolved (fixed in 2.10-1)
trixie: resolved (fixed in 2.10-1)
No detection rules found.
No public exploits indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=2255399https://bugzilla.redhat.com/show_bug.cgi?id=2255399https://lists.fedoraproject.org/archives/list/[email protected]/message/NBTPKR3LYTTLROPXF77FL4SPLXVHNC4T/https://lists.fedoraproject.org/archives/list/[email protected]/message/VG6FHQITWUNHBDGPXUQ77SZK5O5BYIBZ/
2024-04-17
Published