Description
The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier) parses AT responses with roughly twenty handlers that call net_buf_linearize(value, sizeof(value), *buf, 0, len) into a 128-byte stack buffer and then write value[out_len] = 0. Because net_buf_linearize() (lib/net_buf/buf.c) can return a count equal to its destination-length argument, a field that exactly fills the buffer makes the terminating NUL land one byte past the end, a single-byte out-of-bounds write into adjacent stack memory.

The +KCELLMEAS cell-measurement handler on_cmd_atcmdinfo_rssi() is worse: it passed the wire length len as the destination size (net_buf_linearize(value, len, *buf, 0, len)), so a response line longer than 128 bytes overflows the value stack buffer with attacker-influenceable content. The line length comes from net_buf_findcrlf(), which accumulates bytes across the whole net_buf fragment chain and is not bounded to 128, so an over-long line reaches the defect.

The data originates from the cellular modem over UART, driven by the network: operator-scan results, +CGCONTRDP IP/DNS info, socket indications, and +KCELLMEAS neighbour-cell reports. An attacker able to shape what the modem emits — a rogue base station, a compromised modem baseband, or a remote peer feeding oversized response framing — can drive a line past 128 bytes. The handlers run in the driver's RX thread in kernel context, so the corruption is kernel-side.

The +KCELLMEAS path is a full stack buffer overflow whose worst case is code execution in kernel context and whose floor is a reliable crash; the remaining sites are single-byte NUL out-of-bounds writes. Exploitation requires the modem to emit an over-long AT response line, giving high attack complexity over an adjacent (cellular radio) vector. The fix passes sizeof(dst) - 1 (and correct explicit bounds for the IMSI and +KCELLMEAS sites) so the terminator always stays in bounds.
Published: 2026-08-18
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In the Zephyr HL7800 modem driver, a stack buffer overflow exists in several AT‑response handlers. The driver copies 128 bytes into a stack array and then writes a terminating NUL byte, which can be written one byte past the end when the source exactly fills the buffer. The most severe path is the +KCELLMEAS handler, where the destination size is mistakenly set to the received line length. An attacker can cause an AT response line longer than 128 bytes, triggering a full stack overflow that allows kernel‑level code execution. The other handlers perform a single‑byte off‑by‑one NUL overwrite, which, while less dangerous than a full overflow, still corrupts stack memory and can lead to crashes or data tampering.

Affected Systems

The vulnerability is present in the Zephyr project’s HL7800 modem driver (drivers/modem/vendor_standalone/hl7800.c, also located at drivers/modem/hl7800.c) in versions up to and including v4.4.0. Systems using Zephyr firmware that incorporates the HL7800 modem and relies on AT‑command parsing from a cellular radio are affected.

Risk and Exploitability

The CVSS score of 6.4 indicates medium severity, and the lack of an EPSS value means the likelihood of exploitation is currently unknown. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to influence the data the modem emits—via a rogue base station, a compromised modem baseband, or a controlled input over UART—to deliver an AT response line exceeding 128 bytes. The driver runs in the RX thread in kernel context, so a successful exploit could execute code with full kernel privileges. Attack complexity is high due to the need to craft specific AT responses and the requirement that the victim device be connected to the affected modem.

Generated by OpenCVE AI on August 18, 2026 at 20:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Zephyr v4.4.1 or later, which contains the fixed HL7800 driver bounds checks.
  • If upgrading is not immediately feasible, apply the expert patch from commit ea91f9375677aa4268e4044e096902dbe789f101, then rebuild the Zephyr firmware to include the corrected driver.
  • As a temporary countermeasure, configure the HL7800 modem to reject or truncate AT responses exceeding 128 bytes, or disable AT command processing on critical interfaces until the patch is deployed.

Generated by OpenCVE AI on August 18, 2026 at 20:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Tue, 18 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier) parses AT responses with roughly twenty handlers that call net_buf_linearize(value, sizeof(value), *buf, 0, len) into a 128-byte stack buffer and then write value[out_len] = 0. Because net_buf_linearize() (lib/net_buf/buf.c) can return a count equal to its destination-length argument, a field that exactly fills the buffer makes the terminating NUL land one byte past the end, a single-byte out-of-bounds write into adjacent stack memory. The +KCELLMEAS cell-measurement handler on_cmd_atcmdinfo_rssi() is worse: it passed the wire length len as the destination size (net_buf_linearize(value, len, *buf, 0, len)), so a response line longer than 128 bytes overflows the value stack buffer with attacker-influenceable content. The line length comes from net_buf_findcrlf(), which accumulates bytes across the whole net_buf fragment chain and is not bounded to 128, so an over-long line reaches the defect. The data originates from the cellular modem over UART, driven by the network: operator-scan results, +CGCONTRDP IP/DNS info, socket indications, and +KCELLMEAS neighbour-cell reports. An attacker able to shape what the modem emits — a rogue base station, a compromised modem baseband, or a remote peer feeding oversized response framing — can drive a line past 128 bytes. The handlers run in the driver's RX thread in kernel context, so the corruption is kernel-side. The +KCELLMEAS path is a full stack buffer overflow whose worst case is code execution in kernel context and whose floor is a reliable crash; the remaining sites are single-byte NUL out-of-bounds writes. Exploitation requires the modem to emit an over-long AT response line, giving high attack complexity over an adjacent (cellular radio) vector. The fix passes sizeof(dst) - 1 (and correct explicit bounds for the IMSI and +KCELLMEAS sites) so the terminator always stays in bounds.
Title Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-19T13:08:50.519Z

Reserved: 2026-06-17T12:59:12.042Z

Link: CVE-2026-12520

cve-icon Vulnrichment

Updated: 2026-08-19T13:08:42.756Z

cve-icon NVD

Status : Received

Published: 2026-08-18T20:17:11.660

Modified: 2026-08-19T13:17:43.443

Link: CVE-2026-12520

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T21:00:04Z

Weaknesses