PT-2024-13832 · Samsung · Exynos

Published 2024-06-05 · Updated 2024-08-01 · CVE-2023-49927

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 980 through 2200 Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 1280 through 1380 Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 1330 Samsung Mobile Processor, Wearable Processor, and Modem Exynos version 9110 Samsung Mobile Processor, Wearable Processor, and Modem Exynos version 850 Samsung Mobile Processor, Wearable Processor, and Modem Exynos version 1080 Samsung Mobile Processor, Wearable Processor, and Modem Exynos version 2100 Samsung Mobile Processor, Wearable Processor, and Modem Exynos version 2200 Samsung Mobile Processor, Wearable Processor, and Modem Exynos version 1280 Samsung Mobile Processor, Wearable Processor, and Modem Exynos version 1380 Samsung Mobile Processor, Wearable Processor, and Modem Exynos version 1330 Samsung Mobile Processor, Wearable Processor, and Modem Exynos W920 Samsung Mobile Processor, Wearable Processor, and Modem Exynos Modem 5123 Samsung Mobile Processor, Wearable Processor, and Modem Exynos Modem 5300

Description An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem. The baseband software does not properly check format types specified by the RRC. This can lead to a lack of encryption.

Recommendations Update Samsung Mobile Processor, Wearable Processor, and Modem Exynos to a version that includes the fix for this issue. As a temporary workaround, consider disabling the use of the baseband software until a patch is available. Restrict access to the baseband software to minimize the risk of exploitation. Avoid using the RRC format types in the affected baseband software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-331

CWE-311

Related Identifiers

CVE-2023-49927

Affected Products

Exynos

References · 8

• https://semiconductor.samsung.com/support/quality-support/product-security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49927 · Security Note
• https://t.me/cvenotify/83636 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1798451597724323865 · Twitter Post
• https://t.me/cvenotify/82089 · Telegram Post
• https://twitter.com/linuxpatch/status/1798446273596432624 · Twitter Post
• https://twitter.com/CVEnew/status/1798427364868911261 · Twitter Post
• https://t.me/cvenotify/84384 · Telegram Post