PT-2024-28712 · Samsung · Samsung Exynos Modem+2

Published 2024-12-02 · Updated 2025-07-01 · CVE-2024-39890

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Samsung Exynos versions 980 through 9825 Samsung Exynos versions 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110 Samsung Exynos Modem versions 5123, 5300 Samsung Exynos Wearable Processor versions W920, W930, W1000

Description An issue was discovered in the baseband software of Samsung Mobile Processor, Wearable Processor, and Modem Exynos. The software does not properly check the length specified by the CC (Call Control), which can lead to an Out-of-Bounds write.

Recommendations For Samsung Exynos versions 980 through 9825, update the baseband software to a version that properly checks the length specified by the CC. For Samsung Exynos versions 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, restrict access to the baseband software until a patch is available. For Samsung Exynos Modem versions 5123, 5300, consider disabling the modem functionality until a fix is provided. For Samsung Exynos Wearable Processor versions W920, W930, W1000, avoid using the affected processor until the issue is resolved. As a temporary workaround, consider disabling the checkLength() function in the baseband software until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-39890

Affected Products

Samsung Exynos

Samsung Exynos Modem

Samsung Exynos Wearable Processor

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-39890 · Security Note
• https://semiconductor.samsung.com/support/quality-support/product-security-updates · Vendor Advisory
• https://twitter.com/CVEnew/status/1863687217673109539 · Twitter Post
• https://t.me/cvedetector/11822 · Telegram Post
• https://t.me/cvenotify/127245 · Telegram Post