CVE-2024-7547
published 2024-08-06CVE-2024-7547: oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on…
PriorityP349high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
16.5th percentile
oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23460.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ofono | < ofono 2.14-1 (forky) | ofono 2.14-1 (forky) |
| ofono | ofono | — | — |
| ofono | ofono | >= 0 < 2.14-1 | 2.14-1 |
| ofono | ofono | >= 0 < 2.14-1 | 2.14-1 |
| ofono_project | ofono | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.07.0HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
oFono vulnerabilities
vendor_ubuntu·2026-04-16·CVSS 7.8
CVE-2024-7540 [HIGH] oFono vulnerabilities
Title: oFono vulnerabilities
Summary: oFono could be made to crash if it received specially crafted input.
It was discovered that oFono incorrectly handled crafted responses
from AT commands. An attacker could possibly use this issue to crash
the program, resulting in a denial of service or arbitrary code
execution. (CVE-2024-7538, CVE-2024-7539, CVE-2024-7540, CVE-2024-7541,
CVE-2024-7542)
Lucas Leong discovered that oFono incorrectly handled crafted input.
An attacker could possibly use this issue to crash the program,
resulting in a denial of service or arbitrary code execution.
(CVE-2024-7543, CVE-2024-7544, CVE-2024-7545, CVE-2024-7546,
CVE-2024-7547)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2024-7547: ofono - oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability...
vendor_debian·2024·CVSS 7.8
CVE-2024-7547 [HIGH] CVE-2024-7547: ofono - oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability...
oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23460.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.14-1)
sid: resolved (fixed in 2.14-1)
trixie: resolved (fixed in 2.14-1)
GHSA
GHSA-qpm4-pf72-h452: oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability
ghsa_unreviewed·2024-08-06
CVE-2024-7547 [HIGH] CWE-121 GHSA-qpm4-pf72-h452: oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability
oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23460.
OSV
CVE-2024-7547: oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability
osv·2024-08-06·CVSS 7.8
CVE-2024-7547 [HIGH] CVE-2024-7547: oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability
oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23460.
Suricata
ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)
suricata·2016-02-18·CVSS 8.1
CVE-2015-7547 [HIGH] ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)
ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)
Rule: alert tcp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)"; flow:established,to_server; flowbits:set,ET.CVE20157547.primer; flowbits:noalert; byte_test:2,<,513,0; byte_test:1,!&,128,4; byte_test:1,!&,64,4; byte_test:1,!&,32,4; byte_test:1,!&,16,4; byte_test:1,!&,8,4; content:"|00 01 00 00 00 00 00 00|"; offset:6; depth:8; pcre:"/^(?:.[a-z0-9-]{2,}){2,}\x00\x00(?:\x01|\x1c)/Ri"; reference:cve,2015-7547; classtype:attempted-user; sid:2022546; rev:2; metadata:created_at 2016_02_18, cve CVE_2015_7547, confidence Medium, signature_severity Major, updated_at 2024_03_14;)
Suricata
ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query
suricata·2016-02-18·CVSS 8.1
CVE-2015-7547 [HIGH] ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query
ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query
Rule: alert tcp any 53 -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query"; flow:established,to_client; flowbits:isset,ET.CVE20157547.primer; byte_test:2,>,2048,0; byte_test:1,&,128,4; byte_test:1,!&,64,4; byte_test:1,!&,32,4; byte_test:1,!&,16,4; byte_test:1,!&,8,4; content:"|00 01|"; offset:6; depth:2; reference:cve,2015-7547; classtype:attempted-user; sid:2022547; rev:2; metadata:created_at 2016_02_18, cve CVE_2015_7547, confidence Medium, signature_severity Major, updated_at 2024_03_07;)
No public exploits indexed.
No writeups or analysis indexed.
2024-08-06
Published