CVE-2023-4234: 
NixOS vulnerability analysis and mitigation

A critical vulnerability (CVE-2023-4234) was discovered in oFono, an Open Source Telephony stack for Linux. The vulnerability involves a stack overflow bug within the decode_submit_report() function during SMS decoding. The issue was identified and reported in 2023, affecting various versions of the oFono software (Red Hat Bugzilla, ZDI Advisory).

The vulnerability is classified as a stack-based buffer overflow with a CVSS v3.1 base score of 8.1 (HIGH), with a vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The specific flaw exists within the parsing of SMS PDUs, resulting from improper validation of user-supplied data length before copying it to a stack-based buffer. While there is a bound check for the memcpy length in decode_submit(), this check was omitted in decode_submit_report() (ZDI Advisory, Red Hat Bugzilla).

The vulnerability allows remote attackers to execute arbitrary code on affected installations of oFono. An attacker can leverage this vulnerability to execute code in the context of the service account, potentially leading to system compromise. The attack vector can be accessed through a compromised modem, a malicious base station, or via SMS (ZDI Advisory).

The vulnerability can be exploited remotely without requiring authentication. The attack scenario is accessible through multiple vectors including compromised modems, malicious base stations, or SMS messages. The vulnerability was reported to the vendor on May 10, 2023, and was publicly disclosed on December 20, 2023 (ZDI Advisory).

oFono has released updates to address this vulnerability. Various Linux distributions have also provided security updates, including Ubuntu versions 24.10, 24.04, 22.04, 20.04, 18.04, and 16.04. After updating the system, users need to restart oFono to apply all necessary changes (Ubuntu Security Notice).