CVE-2024-7540
published 2024-08-06CVE-2024-7540: oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information…
PriorityP415low3.3CVSS 3.1
AVLACLPRLUINSUCLINAN
EPSS
0.30%
22.0th percentile
oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23307.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ofono | < ofono 2.14-1 (forky) | ofono 2.14-1 (forky) |
| ofono | ofono | — | — |
| ofono | ofono | >= 0 < 2.14-1 | 2.14-1 |
| ofono | ofono | >= 0 < 2.14-1 | 2.14-1 |
| ofono_project | ofono | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv3.03.3LOWCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
osv3.3LOW
vendor_ubuntu7.8HIGH
vendor_debian3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
oFono vulnerabilities
vendor_ubuntu·2026-04-16·CVSS 7.8
CVE-2024-7540 [HIGH] oFono vulnerabilities
Title: oFono vulnerabilities
Summary: oFono could be made to crash if it received specially crafted input.
It was discovered that oFono incorrectly handled crafted responses
from AT commands. An attacker could possibly use this issue to crash
the program, resulting in a denial of service or arbitrary code
execution. (CVE-2024-7538, CVE-2024-7539, CVE-2024-7540, CVE-2024-7541,
CVE-2024-7542)
Lucas Leong discovered that oFono incorrectly handled crafted input.
An attacker could possibly use this issue to crash the program,
resulting in a denial of service or arbitrary code execution.
(CVE-2024-7543, CVE-2024-7544, CVE-2024-7545, CVE-2024-7546,
CVE-2024-7547)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2024-7540: ofono - oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerabilit...
vendor_debian·2024·CVSS 3.3
CVE-2024-7540 [LOW] CVE-2024-7540: ofono - oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerabilit...
oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23307.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.14-1)
sid: resolved (fixed in 2.14-1)
trixie: resolved (fixed in 2.14-1)
GHSA
GHSA-xj99-h8qh-p35c: oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability
ghsa_unreviewed·2024-08-06
CVE-2024-7540 [LOW] CWE-457 GHSA-xj99-h8qh-p35c: oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability
oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23307.
OSV
CVE-2024-7540: oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability
osv·2024-08-06·CVSS 3.3
CVE-2024-7540 [LOW] CVE-2024-7540: oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability
oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23307.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-06
Published