CVE-2024-7543
📋 TL;DR
This heap-based buffer overflow vulnerability in oFono's SimToolKit (STK) command parser allows local attackers with initial code execution on the target modem to escalate privileges and execute arbitrary code in the context of the service account. It affects systems running vulnerable versions of oFono that process STK commands from SIM cards.
💻 Affected Systems
- oFono
📦 What is this software?
Ofono by Ofono Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via privilege escalation to service account, enabling persistent access, data theft, and further lateral movement within the network.
Likely Case
Local privilege escalation allowing attackers to gain higher privileges on the affected modem/system, potentially leading to service disruption or data access.
If Mitigated
Limited impact due to proper access controls, network segmentation, and monitoring preventing initial code execution on the modem.
🎯 Exploit Status
Requires local code execution on the target modem first, then exploitation of the heap overflow for privilege escalation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check oFono repository for latest version with CVE-2024-7543 fix
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-24-1083/
Restart Required: Yes
Instructions:
1. Check oFono repository for security updates. 2. Update to the latest patched version. 3. Restart oFono service. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Disable STK functionality
linuxIf STK features are not required, disable STK command processing in oFono configuration
Modify oFono configuration to disable STK support (specific config varies by deployment)
Restrict modem access
allImplement strict access controls to prevent unauthorized code execution on modems
Use firewall rules to restrict access to modem management interfaces
Implement proper authentication for modem access
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from critical assets
- Deploy strict monitoring and alerting for unusual modem activity or privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check oFono version and compare against patched versions in security advisoriesCheck Version:
ofonod --version or check oFono package version via system package managerVerify Fix Applied:
Verify oFono has been updated to a version that includes the CVE-2024-7543 fix📡 Detection & Monitoring
Log Indicators:
- Unusual STK command processing errors
- Privilege escalation attempts in system logs
- Crash dumps from oFono service
Network Indicators:
- Unexpected modem communication patterns
- Unauthorized access to modem management interfaces
SIEM Query:
Search for oFono service crashes, privilege escalation events, or unusual STK-related log entries