CVE-2024-7545
Publication date 6 August 2024
Last updated 16 April 2026
Ubuntu priority
Description
oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23458.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ofono | 25.10 questing |
Not affected
|
| 24.04 LTS noble |
Fixed 1.31-3ubuntu3.24.04.2+esm1
|
|
| 22.04 LTS jammy |
Fixed 1.31-3ubuntu1.2+esm1
|
|
| 20.04 LTS focal |
Fixed 1.31-2ubuntu1+esm3
|
|
| 18.04 LTS bionic |
Fixed 1.21-1ubuntu1+esm3
|
|
| 16.04 LTS xenial |
Fixed 1.17.bzr6912+16.04.20160314.3-0ubuntu1+esm3
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
bruce
No available patch as of 2024-12-10. Current mitigation is to restrict access with the application.
allenpthuang
Patches have been made available as of 2026-04-13.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.8 · High
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-8178-1
- oFono vulnerabilities
- 16 April 2026