Executive brief
A vulnerability in the Linux kernel's QMI (Qualcomm Message Interface) decoder could allow an attacker to trigger an out-of-bounds buffer write when processing specially crafted network messages containing strings. Devices running affected kernel versions may experience denial of service or potentially allow arbitrary code execution if exploited by an attacker with network access to QMI message processing.
Technical details
The vulnerability is a buffer overflow in the qmi_decode_string_elem() function in drivers/soc/qcom/qmi_encdec.c. The decoder allocates space for null-terminated strings (MAX_LEN + 1 bytes) but fails to properly validate that received string lengths do not equal the maximum allowed length; if a string is exactly MAX_LEN + 1 characters, appending the null terminator writes beyond the allocated buffer boundary. The vulnerability affects QMI TLV (Type-Length-Value) message decoding and requires network-reachable access to QMI message processing. A patch changes the validation from "string_len > temp_ei->elem_len" to "string_len >= temp_ei->elem_len" to properly reject oversized strings. The fix has been applied to stable kernel branches.
Affected products
- Linux Linux kernel Versions with vulnerable qmi_encdec.c prior to upstream commit 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 (released 2023-09-19); original issue introduced by commit 9b8a11e82615
Timeline
- 2023-09-19: disclosed: Fix committed to stable Linux kernel branches
- 2023-09-19: patched: Upstream fix: commit 8d207400fd6b79c92aeb2f33bb79f62dff904ea2; backported to stable kernels
- 2025-10-22: advisory: CVE-2023-53729 published on NVD