The Sierra Wireless HL7800 cellular modem driver in Zephyr (drivers/modem/hl7800.c) parses AT responses into a fixed 128-byte stack buffer using net_buf_linearize(). In several handlers, including the +KCELLMEAS cell-measurement handler, improper bounds checking allows an attacker-controlled AT response line longer than 128 bytes to overflow the stack buffer. The +KCELLMEAS handler passes the wire length as the destination size, enabling a full stack buffer overflow. The vulnerability arises because net_buf_linearize() can return a count equal to the destination length, causing the terminating NUL byte to be written one byte past the buffer end. The data originates from the cellular modem over UART, and an attacker capable of influencing modem output (e.g., via a rogue base station or compromised modem baseband) can trigger this overflow. The overflow occurs in kernel context, risking kernel memory corruption and potential code execution. The fix involves correcting the bounds passed to net_buf_linearize() to ensure the terminating NUL byte remains within buffer limits.

This vulnerability can lead to kernel memory corruption due to out-of-bounds writes in the modem driver's AT response parsing code. The worst-case impact is arbitrary code execution in kernel context, while the minimum impact is a reliable kernel crash. Exploitation complexity is high because it requires an attacker to control the modem's emitted AT response lines over a cellular interface. There are no known exploits in the wild.

A fix is available that corrects the bounds checking in the affected handlers by passing sizeof(destination) - 1 to net_buf_linearize(), ensuring the terminating NUL byte does not overflow the buffer. Users should upgrade to Zephyr version 4.4.2 or later where this issue is resolved. Until patched, limiting exposure to untrusted cellular networks or modems may reduce risk, but no vendor advisory indicates alternative mitigations or that the issue is already mitigated.