PT-2024-21862 · Samsung · Exynos 1380+4

Published 2024-06-05 · Updated 2024-08-21 · CVE-2024-27375

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:H/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Samsung Mobile Processor Exynos 980 Samsung Mobile Processor Exynos 850 Samsung Mobile Processor Exynos 1280 Samsung Mobile Processor Exynos 1380 Samsung Mobile Processor Exynos 1330

Description An issue was discovered in the function slsi nan followup get nl params(), where there is no input validation check on hal req->sdea service specific info len coming from userspace, which can lead to a heap overwrite.

Recommendations For Samsung Mobile Processor Exynos 980, ensure you patch up to prevent a heap overwrite. For Samsung Mobile Processor Exynos 850, ensure you patch up to prevent a heap overwrite. For Samsung Mobile Processor Exynos 1280, ensure you patch up to prevent a heap overwrite. For Samsung Mobile Processor Exynos 1380, ensure you patch up to prevent a heap overwrite. For Samsung Mobile Processor Exynos 1330, ensure you patch up to prevent a heap overwrite. As a temporary workaround, consider disabling the slsi nan followup get nl params() function until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

CWE-1288

Related Identifiers

CVE-2024-27375

Affected Products

Exynos 1280

Exynos 1330

Exynos 1380

Exynos 850

Exynos 980

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-27375 · Security Note
• https://semiconductor.samsung.com/support/quality-support/product-security-updates · Vendor Advisory
• https://twitter.com/linuxpatch/status/1798447679476748722 · Twitter Post
• https://twitter.com/CVEnew/status/1798427372154437983 · Twitter Post
• https://t.me/cvenotify/82098 · Telegram Post
• https://t.me/cvenotify/91596 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1798453874899996847 · Twitter Post
• https://t.me/cvenotify/84681 · Telegram Post