The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c parses the PDP-context dynamic parameters (local address, subnet mask, gateway, and DNS servers) that the cellular network assigns to the device. The response is linearized into a 256-byte stack buffer, after which each address field length is computed from comma/. delimiter positions in the network-supplied data and used directly as the length argument to strncpy() into the fixed 64-byte stack buffer temp_addr_str (and the 16-byte iface_ctx.dns_v4_string).
Because the field length is derived from attacker-controlled delimiter positions and was not bounded against the destination buffer, a single field can be far larger than 64 bytes. A malicious or impersonated cellular network (for example a rogue base station) can return a crafted +CGCONTRDP response with an overlong address field, causing strncpy() to write past temp_addr_str on the modem worker thread's stack, plus an out-of-bounds NUL write at temp_addr_str[addr_len].
No device-side privileges or user interaction are required: the device itself issues the AT+CGCONTRDP=1 query during normal network attach and parses whatever the network returns. The overflow corrupts adjacent stack memory in supervisor context, yielding at minimum a remotely triggerable crash and potentially control-flow hijacking on targets without stack protection.
The fix bounds every field length against its destination buffer (temp_addr_str and dns_v4_string) before each copy, rejecting overlong fields.
Affected components
drivers/modem/vendor_standalone/hl7800.c
Affected versions
>= 2.4.0, < 4.4.2
Fix
Fixed (merged) in a1cbced
Fixed in 4.4.2. Release lines that have not yet taken the backport remain affected — see the affected version range above.
Introduced by: present since the hl7800 +CGCONTRDP handler was added; shipped in releases (e.g. v4.4.0 at drivers/modem/hl7800.c)
Evidence
- drivers/modem/vendor_standalone/hl7800.c:2118-2128 — addr_len derived from network-supplied delimiter positions; pre-fix strncpy into temp_addr_str had no bound check
- drivers/modem/vendor_standalone/hl7800.c:2069 — temp_addr_str[HL7800_IPV6_ADDR_LEN] (64 bytes) destination
- drivers/modem/vendor_standalone/hl7800.c:290-291 — HL7800_IPV6_ADDR_LEN = sizeof("a01...a16") = 64
- drivers/modem/vendor_standalone/hl7800.c:432 — dns_v4_string[NET_IPV4_ADDR_LEN] = 16 bytes, also overflowed (now guarded)
- drivers/modem/vendor_standalone/hl7800.c:2063,199 — value[MDM_IP_INFO_RESP_SIZE]=256 holds the network response; a field can exceed 64
- drivers/modem/vendor_standalone/hl7800.c:4694 — CMD_HANDLER("+CGCONTRDP: ", atcmdinfo_ipaddr) registers the handler against modem responses
- git show v4.4.0:drivers/modem/hl7800.c:2119-2120 — same unbounded strncpy(temp_addr_str, addr_start, addr_len) shipped in v4.4.0 (path relocated later)
Patches
For more information
If you have any questions or comments about this advisory:
embargo: 2026-08-16
The HL7800 cellular modem driver's
+CGCONTRDP:response handleron_cmd_atcmdinfo_ipaddr()indrivers/modem/vendor_standalone/hl7800.cparses the PDP-context dynamic parameters (local address, subnet mask, gateway, and DNS servers) that the cellular network assigns to the device. The response is linearized into a 256-byte stack buffer, after which each address field length is computed from comma/.delimiter positions in the network-supplied data and used directly as the length argument tostrncpy()into the fixed 64-byte stack buffertemp_addr_str(and the 16-byteiface_ctx.dns_v4_string).Because the field length is derived from attacker-controlled delimiter positions and was not bounded against the destination buffer, a single field can be far larger than 64 bytes. A malicious or impersonated cellular network (for example a rogue base station) can return a crafted
+CGCONTRDPresponse with an overlong address field, causingstrncpy()to write pasttemp_addr_stron the modem worker thread's stack, plus an out-of-bounds NUL write attemp_addr_str[addr_len].No device-side privileges or user interaction are required: the device itself issues the
AT+CGCONTRDP=1query during normal network attach and parses whatever the network returns. The overflow corrupts adjacent stack memory in supervisor context, yielding at minimum a remotely triggerable crash and potentially control-flow hijacking on targets without stack protection.The fix bounds every field length against its destination buffer (
temp_addr_stranddns_v4_string) before each copy, rejecting overlong fields.Affected components
drivers/modem/vendor_standalone/hl7800.cAffected versions
>= 2.4.0, < 4.4.2Fix
Fixed (merged) in a1cbced
Fixed in 4.4.2. Release lines that have not yet taken the backport remain affected — see the affected version range above.
Introduced by: present since the hl7800 +CGCONTRDP handler was added; shipped in releases (e.g. v4.4.0 at drivers/modem/hl7800.c)
Evidence
Patches
mainv4.4-branchv4.3-branchv3.7-branchFor more information
If you have any questions or comments about this advisory:
embargo: 2026-08-16