The Sierra Wireless HL7800 cellular modem driver in Zephyr (up to v4.4.0) parses AT command responses into a fixed 128-byte stack buffer using net_buf_linearize(). Some handlers incorrectly allow the terminating NUL byte to be written one byte past the buffer boundary, causing a single-byte out-of-bounds write. The +KCELLMEAS handler is more severe, passing the unbounded line length as the buffer size, enabling a full stack buffer overflow if the line exceeds 128 bytes. This overflow can be triggered by attacker-controlled modem responses, such as from a rogue base station or compromised modem baseband, and runs in kernel RX thread context. The worst-case impact is kernel code execution; the minimum impact is a reliable kernel crash. The fix involves correctly bounding the buffer size to ensure the terminating NUL stays within the buffer.

The vulnerability allows an attacker able to influence cellular modem AT responses to cause out-of-bounds memory writes in kernel context. The +KCELLMEAS handler's full stack buffer overflow can lead to kernel code execution, while other handlers cause single-byte out-of-bounds writes that may result in crashes or data corruption. Exploitation complexity is high due to the need to control modem output over the cellular radio vector. There are no known exploits in the wild. The CVSS score is 6.4, indicating medium severity with impacts on confidentiality, integrity, and high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves passing the correct buffer size (sizeof(dst) - 1) to prevent out-of-bounds writes. Until an official fix is available, limit exposure to untrusted cellular modem responses where possible. Monitor vendor channels for patches or updates addressing this issue.