Lucene search

MitreCVE-2024-27382

HistoryJun 05, 2024 - 7:15 p.m.

CVE-2024-27382

2024-06-0519:15:14

CWE-125

mitre

web.nvd.nist.gov

samsung

exynos

vulnerability

input validation

heap over-read

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

6.8

Confidence

Low

JSON

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame(), there is no input validation check on len coming from userspace, which can lead to a heap over-read.

Affected configurations

Nvd

Node

samsungexynos_980_firmwareMatch-

AND

samsungexynos_980Match-

Node

samsungexynos_850_firmwareMatch-

AND

samsungexynos_850Match-

Node

samsungexynos_1280_firmwareMatch-

AND

samsungexynos_1280Match-

Node

samsungexynos_1380_firmwareMatch-

AND

samsungexynos_1380Match-

Node

samsungexynos_1330_firmwareMatch-

AND

samsungexynos_1330Match-

VendorProductVersionCPE
samsungexynos_980_firmware-cpe:2.3:o:samsung:exynos_980_firmware:-:*:*:*:*:*:*:*
samsungexynos_980-cpe:2.3:h:samsung:exynos_980:-:*:*:*:*:*:*:*
samsungexynos_850_firmware-cpe:2.3:o:samsung:exynos_850_firmware:-:*:*:*:*:*:*:*
samsungexynos_850-cpe:2.3:h:samsung:exynos_850:-:*:*:*:*:*:*:*
samsungexynos_1280_firmware-cpe:2.3:o:samsung:exynos_1280_firmware:-:*:*:*:*:*:*:*
samsungexynos_1280-cpe:2.3:h:samsung:exynos_1280:-:*:*:*:*:*:*:*
samsungexynos_1380_firmware-cpe:2.3:o:samsung:exynos_1380_firmware:-:*:*:*:*:*:*:*
samsungexynos_1380-cpe:2.3:h:samsung:exynos_1380:-:*:*:*:*:*:*:*
samsungexynos_1330_firmware-cpe:2.3:o:samsung:exynos_1330_firmware:-:*:*:*:*:*:*:*
samsungexynos_1330-cpe:2.3:h:samsung:exynos_1330:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
samsung	exynos_980_firmware	-	cpe:2.3:o:samsung:exynos_980_firmware:-:::::::*
samsung	exynos_980	-	cpe:2.3:h:samsung:exynos_980:-:::::::*
samsung	exynos_850_firmware	-	cpe:2.3:o:samsung:exynos_850_firmware:-:::::::*
samsung	exynos_850	-	cpe:2.3:h:samsung:exynos_850:-:::::::*
samsung	exynos_1280_firmware	-	cpe:2.3:o:samsung:exynos_1280_firmware:-:::::::*
samsung	exynos_1280	-	cpe:2.3:h:samsung:exynos_1280:-:::::::*
samsung	exynos_1380_firmware	-	cpe:2.3:o:samsung:exynos_1380_firmware:-:::::::*
samsung	exynos_1380	-	cpe:2.3:h:samsung:exynos_1380:-:::::::*
samsung	exynos_1330_firmware	-	cpe:2.3:o:samsung:exynos_1330_firmware:-:::::::*
samsung	exynos_1330	-	cpe:2.3:h:samsung:exynos_1330:-:::::::*

References

semiconductor.samsung.com/support/quality-support/product-security-updates/

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

6.8

Confidence

Low

JSON

Related for CVE-2024-27382