Bug 2489128 (CVE-2026-54881)

A heap-based buffer overflow vulnerability was found in oFono's QMI modem network registration driver. The function scan_nets_cb() in drivers/qmimodem/network-registration.c copies a network operator description from a QMI NAS NETWORK_SCAN response TLV into the heap-allocated list[i].name buffer (char[64], OFONO_MAX_OPERATOR_NAME_LENGTH + 1) using strncpy with netinfo->desc_len as the length. Since netinfo->desc_len is a uint8_t field from the modem-controlled QMI TLV (range 0-255) and no bounds check is performed against the 64-byte buffer size, an attacker can supply a desc_len value greater than 64.

Two overflows occur: (1) strncpy writes up to 255 bytes into the 64-byte name buffer (line 328), and (2) a NUL terminator is written at name[desc_len] which can be up to 191 bytes past the buffer end (line 329). The list array is heap-allocated via l_new, so this corrupts adjacent heap objects.

The vulnerability can be triggered by a rogue USB QMI modem or compromised Qualcomm baseband firmware returning crafted NAS NETWORK_SCAN responses with an oversized operator name. The scan is triggered when a user performs manual network selection, when NetworkManager/ConnMan auto-scans, or via the org.ofono.NetworkRegistration.Scan D-Bus method. Since ofonod runs as root with no sandbox, successful exploitation of the heap corruption could lead to arbitrary code execution with root privileges.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.