Samsung Users at Risk: 18 Zero-Day Vulnerabilities Found in Exynos Chipsets

Google’s Project Zero uncovers 18 zero-day vulnerabilities in Samsung Exynos chipsets

Google’s bug-hunting team, Project Zero, has identified 18 zero-day vulnerabilities in Samsung’s Exynos chipsets used in mobile devices, wearables, and cars. These vulnerabilities were discovered between late 2022 and early 2023, and four of them were deemed the most serious. The flaws allow remote code execution from the Internet to the baseband, enabling attackers to compromise vulnerable devices without any user interaction.

The security flaws, including CVE-2023-24033 and three others still awaiting a CVE-ID, were described as “Internet-to-baseband remote code execution (RCE) bugs.” Samsung acknowledged the vulnerability in a security advisory, stating that the baseband software does not properly check the format types of accept-type attribute specified by the SDP, which can lead to denial of service or code execution in Samsung Baseband Modem.

Four of the identified Exynos modem security flaws enable remote code execution

Tim Willis, the Head of Project Zero, has warned that experienced attackers could easily create an exploit that remotely compromises vulnerable devices without triggering the target’s attention. Due to the high level of access these vulnerabilities provide, Project Zero has delayed disclosure for the four vulnerabilities that allow for Internet-to-baseband remote code execution.

The remaining 14 flaws, including CVE-2023-24072, CVE-2023-24073, CVE-2023-24074, CVE-2023-24075, CVE-2023-24076, and nine others awaiting CVE-IDs, are less critical but still pose a risk. Successful exploitation requires local access or a malicious mobile network operator.

Samsung has already provided security updates addressing these vulnerabilities in impacted chipsets to other vendors. However, patches are not public and can’t be applied by all affected users. Each manufacturer’s patch timeline for their devices will differ. Google, for instance, has already addressed CVE-2023-24033 for impacted Pixel devices in its March 2023 security updates.

Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: [email protected]

Source: bleepingcomputer.com

Source Link