Description

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01371002; Issue ID: MSV-9020.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T02:17:19.030Z",
  "pubdate": "2026-09-07T02:17:19.030Z",
  "executiveSummary": "A critical vulnerability exists within the Modem firmware, classified as a missing bounds check. This security flaw allows an attacker to induce a system crash, resulting in a remote denial of service (DoS) condition.\nThe vulnerability is exploitable when a User Equipment (UE) device establishes a connection with a rogue base station orchestrated by an attacker. No user interaction or elevated execution privileges are required to trigger this exploit.\nThe risk implication is significant as it facilitates unauthorized service disruption by exploiting the communication protocol stack. By simulating a malicious base station, an attacker can send specially crafted packets that trigger the out-of-bounds error, leading to a complete system hang or reset of the modem component.\nThis vulnerability, identified as MSV-9020 (Patch ID: MOLY01371002), highlights the inherent risks of processing unvalidated data within low-level firmware components that lack sufficient input sanitization. Addressing this requires firmware updates to implement rigorous length verification and bounds checking for all incoming protocol messages.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of inbound data packets within the modem's protocol stack, specifically due to a failure to perform adequate bounds checking on received buffers. When the Modem parses messages transmitted over the air interface, the logic fails to verify that the length of the data conforms to the allocated memory buffer size.\nThe exploitation flow begins when the target UE performs a cell search and attempts to connect to a rogue base station acting as a malicious transmitter. Once the connection is established, the attacker sends a specifically malformed sequence of data packets designed to exceed the predetermined memory boundary. Because the modem firmware lacks the necessary safety checks, the processing logic writes data into unauthorized memory regions or attempts to access memory outside the intended scope.\nThis out-of-bounds access triggers a memory corruption event or a segmentation fault within the modem's execution environment. Depending on the memory management unit (MMU) configuration and the specific implementation of the radio stack, this either results in a kernel panic, a processor exception, or an infinite loop that halts the modem's functionality entirely. Since the modem serves as the primary gateway for cellular connectivity, the resulting crash effectively isolates the UE from the network, fulfilling the criteria for a remote denial of service.\nBecause the modem operates at a privilege level independent of the user-space applications, the vulnerability does not require any execution privileges on the host operating system. The exploit occurs entirely within the firmware domain, bypassing standard Android or OS-level security policies. The payload consists of standard cellular signaling protocols that are interpreted as valid by the modem until the bounds violation is triggered. Consequently, the modem reaches a non-responsive state that requires a hardware-level reset or a power cycle to recover, confirming the impact of a total denial of service attack."
}