VDB
CVE-2023-2794
CVE-2023-2794
PUBLISHED
CVSS 8.100000381469727 HIGH
A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_deliver().
EPSS 1.25% · 69.1th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.25%
69.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| 2.5 | ||
| linux | ofono | 0 |
| ofono_project | ofono | 0, 0 |
| fedoraproject | fedora | 40, 39, 39 |
Timeline
- Dec 20, 2023 CVE Published
- Apr 11, 2024 EPSS Score
- May 7, 2024 EPSS Score
- Jun 2, 2024 EPSS Score
- Jun 28, 2024 EPSS Score
- Jul 24, 2024 EPSS Score
- Sep 13, 2024 EPSS Score
- Oct 9, 2024 EPSS Score
- Nov 4, 2024 EPSS Score
- Nov 30, 2024 EPSS Score
- Dec 27, 2024 EPSS Score
- Jan 22, 2025 EPSS Score
References
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLAWJAAS3HDI2KMCZXF4DMR3Y4BQNMKO url
- https://bugzilla.redhat.com/show_bug.cgi?id=2255387 exploit
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLAWJAAS3HDI2KMCZXF4DMR3Y4BQNMKO/ url
- https://nvd.nist.gov/vuln/detail/CVE-2023-2794 advisory