Executive brief
The Sierra Wireless HL78xx modem's GNSS receiver driver contains a memory layout bug that causes GPS/GNSS data parsing callbacks to write to incorrect memory locations. An attacker who can broadcast spoofed GNSS signals near an affected device can trigger kernel memory corruption or system crash, disrupting navigation and time-synchronization services that depend on GNSS.
Technical details
The vulnerability is a type confusion caused by struct member ordering: the generic gnss_nmea0183_match_data context struct is embedded at a non-zero offset within hl78xx_gnss_data, but initialization code and parse callbacks operate with different base addresses. When GNSS receivers transmit NMEA sentences, the GSV callback reads a satellites pointer and bound from misaligned offsets (interpreting non-pointer data as pointers), then performs an uncontrolled write through the bogus pointer. The attack vector is adjacent-network GNSS radio proximity; preconditions include CONFIG_HL78XX_GNSS_SOURCE_NMEA enabled (default) and CONFIG_GNSS_SATELLITES active. Impact is primarily denial of service via kernel crash; memory corruption is possible on MMU-less targets. No fix/patch details are provided in the advisory.
Affected products
- Sierra Wireless HL78xx modem GNSS driver affected releases with match_data as second member in struct hl78xx_gnss_data
Timeline
- 2026-09-10: disclosed