PT-2024-7445 · Samsung · Samsung Android

Published 2024-05-07 · Updated 2025-02-10 · CVE-2024-20865

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Samsung Android mobile devices (affected versions not specified) Samsung Android mobile devices versions prior to SMR May-2024 Release 1

Description: The issue is related to weaknesses in the authentication procedure of the bootloader component in Samsung Android mobile devices. This can allow an attacker to bypass authentication and potentially impact the confidentiality, integrity, and availability of protected information. The vulnerability can be exploited by physical attackers to flash arbitrary images.

Recommendations: For versions prior to SMR May-2024 Release 1, update to the SMR May-2024 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting physical access to the device to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-08824

CVE-2024-20865

Affected Products

Samsung Android

References · 19

• 🔥 https://github.com/quarkslab/samsung-bootchain-poc · Exploit
• https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=05 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20865 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-20865 · Security Note
• https://bdu.fstec.ru/vul/2024-08824 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20865 · Vendor Advisory
• https://twitter.com/paramdhagia/status/1846760108664955165 · Twitter Post
• https://twitter.com/paramdhagia/status/1846760387737174300 · Twitter Post
• https://sammyfans.com/2024/05/07/samsung-reveals-may-2024-security-update-fixes-45-vulnerabilities · Note
• https://t.me/cvenotify/79345 · Telegram Post
• https://twitter.com/paramdhagia/status/1846760447044657495 · Twitter Post
• https://t.me/cybersecuritytechnologies/11294 · Telegram Post
• https://vulners.com/cve/CVE-2024-20865 · Note
• https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=05 · Note
• https://t.me/cvenotify/110695 · Telegram Post