Heap Overwrite Vulnerability Affects Samsung Mobile Processors
CVE-2024-27383

7.8HIGH

Key Information:

Vendor
Samsung
Status
Exynos 980 Firmware
Vendor
CVE Published:
9 September 2024

Summary

A vulnerability affecting Samsung's Exynos mobile processors including models 980, 850, 1280, 1380, and 1330 has been identified. The flaw arises in the function slsi_get_scan_extra_ies(), where the system fails to perform adequate input validation on data sourced from userspace. This oversight can potentially lead to a heap overwrite, allowing attackers to manipulate the memory allocation process and execute arbitrary code, posing significant security risks to devices utilizing these processors.

References

https://semiconductor.samsung.com/support/quality-support...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.