PT-2025-2817 · Samsung · Exynos 1280+18

Beomseok Oh

+4

·

Published

2025-01-06

·

Updated

2025-01-14

·

CVE-2024-48883

CVSS v3.1

4.3

Medium

VectorAV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 980 through 9825 Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110 Samsung Mobile Processor, Wearable Processor, and Modem Exynos W920, W930, W1000 Samsung Mobile Processor, Wearable Processor, and Modem Modem 5123, Modem 5300
Description: The issue is related to the incorrect handling of a malformed uplink scheduling message by the UE, resulting in an information leak of the UE. This occurs in the Samsung Mobile Processor, Wearable Processor, and Modem Exynos chipsets.
Recommendations: For Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 980 through 9825, update to a newer version that contains a fix for this issue. For Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, update to a newer version that contains a fix for this issue. For Samsung Mobile Processor, Wearable Processor, and Modem Exynos W920, W930, W1000, update to a newer version that contains a fix for this issue. For Samsung Mobile Processor, Wearable Processor, and Modem Modem 5123, Modem 5300, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting the handling of uplink scheduling messages to minimize the risk of exploitation.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2024-48883

Affected Products

Exynos
Exynos 1080
Exynos 1280
Exynos 1330
Exynos 1380
Exynos 1480
Exynos 2100
Exynos 2200
Exynos 2400
Exynos 850
Exynos 9110
Exynos 980
Exynos 9825
Exynos 990
Exynos W1000
Exynos W920
Exynos W930
Modem 5123
Modem 5300