PT-2024-21869 · Samsung · Exynos 1380+4

Published 2024-06-05 · Updated 2024-06-27 · CVE-2024-27381

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AC:L/AV:L/A:H/C:H/I:N/PR:H/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Samsung Mobile Processor Exynos 980 Samsung Mobile Processor Exynos 850 Samsung Mobile Processor Exynos 1280 Samsung Mobile Processor Exynos 1380 Samsung Mobile Processor Exynos 1330

Description An issue was discovered in the function slsi send action frame ut(), where there is no input validation check on len coming from userspace, which can lead to a heap over-read.

Recommendations For Samsung Mobile Processor Exynos 980, consider disabling the slsi send action frame ut() function until a patch is available. For Samsung Mobile Processor Exynos 850, restrict access to the vulnerable function slsi send action frame ut() to minimize the risk of exploitation. For Samsung Mobile Processor Exynos 1280, avoid using the len variable in the affected function until the issue is resolved. For Samsung Mobile Processor Exynos 1380, as a temporary workaround, consider restricting the input from userspace to prevent the heap over-read. For Samsung Mobile Processor Exynos 1330, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-27381

Affected Products

Exynos 1280

Exynos 1330

Exynos 1380

Exynos 850

Exynos 980

References · 6

• https://semiconductor.samsung.com/support/quality-support/product-security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27381 · Security Note
• https://t.me/cvenotify/84678 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1798455393221234951 · Twitter Post
• https://twitter.com/CVEnew/status/1798427378328408164 · Twitter Post
• https://t.me/cvenotify/82104 · Telegram Post