A heap-based buffer overflow vulnerability was found in oFono's HDLC (High-Level Data Link Control) decoder. The new_bytes() function in gatchat/gathdlc.c writes incoming serial data bytes into a heap-allocated decode_buffer of 4096 bytes (BUFFER_SIZE = 2 * 2048) using a decode_offset counter that is only reset to 0 when a HDLC flag byte (0x7E) is received. There is no bounds check comparing decode_offset against BUFFER_SIZE before writing to decode_buffer[decode_offset++] at lines 288 and 309.

If a compromised modem sends more than 4096 bytes without a HDLC flag byte, decode_offset increments past BUFFER_SIZE and subsequent writes corrupt heap memory beyond the allocated buffer. This is a particularly powerful exploitation primitive because the attacker controls: (1) the write offset — determined by how many bytes are sent without a flag, which can be arbitrarily large, (2) the written value — each byte is the raw byte from the serial link or byte XOR 0x20 for escaped bytes, (3) the write granularity — byte-by-byte for precise heap corruption, and (4) the state persists across multiple new_bytes() callback invocations.

The HDLC layer is used in two contexts: PPP data connections (when an AT modem establishes a data call via ATD*99# or AT+CGDATA) and GSM 07.10 Advanced MUX mode. In both cases, a compromised baseband modem has direct control over the raw bytes on the serial link. Since ofonod runs as root with no sandbox, successful exploitation of the heap corruption could lead to arbitrary code execution with root privileges.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.