PT-2024-13970 · Samsung · Exynos 1380+12

Published 2024-06-05 · Updated 2024-06-27 · CVE-2023-50804

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AC:H/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Samsung Mobile Processor and Modem Exynos versions 9820 through 9825 Samsung Mobile Processor and Modem Exynos versions 980 through 990 Samsung Mobile Processor and Modem Exynos versions 850 through 1080 Samsung Mobile Processor and Modem Exynos versions 2100 through 2200 Samsung Mobile Processor and Modem Exynos versions 1280 through 1380 Samsung Mobile Processor and Modem Exynos version 1330 Exynos Modem 5123 Exynos Modem 5300 Auto T5123

Description An issue was discovered in the baseband software of Samsung Mobile Processor and Modem Exynos, where it does not properly check format types specified by the NAS (Non-Access-Stratum) module. This can lead to bypass of authentication.

Recommendations For Exynos 9820 through 9825, update the baseband software to properly check format types specified by the NAS module. For Exynos 980 through 990, update the baseband software to properly check format types specified by the NAS module. For Exynos 850 through 1080, update the baseband software to properly check format types specified by the NAS module. For Exynos 2100 through 2200, update the baseband software to properly check format types specified by the NAS module. For Exynos 1280 through 1380, update the baseband software to properly check format types specified by the NAS module. For Exynos 1330, update the baseband software to properly check format types specified by the NAS module. For Exynos Modem 5123, update the baseband software to properly check format types specified by the NAS module. For Exynos Modem 5300, update the baseband software to properly check format types specified by the NAS module. For Auto T5123, update the baseband software to properly check format types specified by the NAS module. As a temporary workaround, consider restricting access to the NAS module until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-50804

Affected Products

Exynos 1080

Exynos 1280

Exynos 1330

Exynos 1380

Exynos 2100

Exynos 2200

Exynos 850

Exynos 980

Exynos 9820

Exynos 9825

Exynos 990

Exynos Modem 5123

Exynos Modem 5300

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-50804 · Security Note
• https://semiconductor.samsung.com/support/quality-support/product-security-updates · Vendor Advisory
• https://twitter.com/linuxpatch/status/1798446577419182573 · Twitter Post
• https://twitter.com/CVEnew/status/1798432690212835560 · Twitter Post
• https://t.me/cvenotify/82092 · Telegram Post
• https://t.me/cvenotify/84385 · Telegram Post
• https://t.me/cvenotify/84694 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1798452356687798468 · Twitter Post