Lucene search

SamsungMobileCVE-2024-34637

HistorySep 04, 2024 - 6:15 a.m.

CVE-2024-34637

2024-09-0406:15:11

SamsungMobile

web.nvd.nist.gov

access control

android 12

android 13

android 14

local attackers

service restrictions

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.6%

JSON

Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows local attackers to bypass restrictions on starting services from the background.

Affected configurations

Nvd

Node

samsungandroidMatch12.0-

samsungandroidMatch12.0smr_sep-2024-r1

samsungandroidMatch13.0-

samsungandroidMatch13.0smr-jun-2024-r1

samsungandroidMatch14.0-

samsungandroidMatch14.0smr-jun-2024-r1

VendorProductVersionCPE
samsungandroid12.0cpe:2.3:o:samsung:android:12.0:-:*:*:*:*:*:*
samsungandroid12.0cpe:2.3:o:samsung:android:12.0:smr_sep-2024-r1:*:*:*:*:*:*
samsungandroid13.0cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:*
samsungandroid13.0cpe:2.3:o:samsung:android:13.0:smr-jun-2024-r1:*:*:*:*:*:*
samsungandroid14.0cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:*
samsungandroid14.0cpe:2.3:o:samsung:android:14.0:smr-jun-2024-r1:*:*:*:*:*:*

Vendor	Product	Version	CPE
samsung	android	12.0	cpe:2.3:o:samsung:android:12.0:-::::::
samsung	android	12.0	cpe:2.3:o:samsung:android:12.0:smr_sep-2024-r1::::::
samsung	android	13.0	cpe:2.3:o:samsung:android:13.0:-::::::
samsung	android	13.0	cpe:2.3:o:samsung:android:13.0:smr-jun-2024-r1::::::
samsung	android	14.0	cpe:2.3:o:samsung:android:14.0:-::::::
samsung	android	14.0	cpe:2.3:o:samsung:android:14.0:smr-jun-2024-r1::::::

CNA Affected

[
  {
    "vendor": "Samsung Mobile",
    "product": "Samsung Mobile Devices",
    "versions": [
      {
        "status": "unaffected",
        "version": "SMR Sep-2024 Release in SMR Sep-2024 Release 1 in Android 12 and SMR Jun-2024 Release 1 in Android 13, 14"
      }
    ],
    "defaultStatus": "affected"
  }
]

References

security.samsungmobile.com/securityUpdate.smsb?year=2024&month=09

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-34637