CVE-2023-2794: 
NixOS vulnerability analysis and mitigation

A critical vulnerability (CVE-2023-2794) was discovered in oFono, an Open Source Telephony system on Linux. The vulnerability was reported on May 17, 2023, and publicly disclosed on December 20, 2023. This flaw involves a stack-based buffer overflow in the SMS decoding functionality, specifically within the decode_deliver() function (ZDI Advisory, NVD).

The vulnerability stems from improper validation of user-supplied data length before copying it to a stack-based buffer in the decode_deliver() function. While there is a bound check for memcpy length in decode_submit(), this check was omitted in decode_deliver(). The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating its severe nature (ZDI Advisory).

The vulnerability allows remote attackers to execute arbitrary code on affected installations of oFono without requiring authentication. An attacker can leverage this vulnerability to execute code in the context of the service account. The attack vector could be exploited through a compromised modem, a malicious base station, or via SMS (NVD, ZDI Advisory).

The vulnerability can be exploited remotely without requiring authentication or user interaction. The attack complexity is considered high, but successful exploitation could lead to complete system compromise. The vulnerability has been classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) (NVD).

oFono has released an update to address this vulnerability. The fix has been implemented in version 2.14-1 for some distributions. Users are strongly advised to update to the latest version of oFono that contains the security patch (Debian Tracker, Red Hat Bugzilla).