OnePlus 7 Pro Information Disclosure Vulnerability

The OnePlus 7 Pro is a smartphone from China's Wampus Technology OnePlus. A security vulnerability exists in versions prior to OnePlus 7 Pro 10.0.3.GM21BA. The vulnerability can be exploited by an attacker to obtain a fingerprint image bitmap from the fingerprint sensor...

CVE-2020-7958

An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user root in the Rich Execution Environment REE to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the...

CVE-2020-7958

An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user root in the Rich Execution Environment REE to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the...

Design/Logic Flaw

An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user root in the Rich Execution Environment REE to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the...

CVE-2020-7958

An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user root in the Rich Execution Environment REE to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the...

CVE-2020-7958

An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user root in the Rich Execution Environment REE to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the...

CVE-2020-7958

The CVE-2020-7958 entry concerns OnePlus 7 Pro devices (prior to 10.0.3.GM21BA). A leftover-debug-code issue in the firmware allows a privileged root user in the Rich Execution Environment (REE) to obtain bitmap fingerprint images from the sensor. The root cause is that the Trusted Application (T...

Threat Source newsletter for April 9, 2020

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. Nearly all devices have some sort of fingerprint scanner now, used to log users in. But these scanners prevent their own unique attack...

CVE-2018-21051

An issue was discovered on Samsung mobile devices with N7.x and O8.x Exynos chipsets software. There is an invalid free in the fingerprint Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2018-12853 October 2018...

CVE-2018-21051

An issue was discovered on Samsung mobile devices with N7.x and O8.x Exynos chipsets software. There is an invalid free in the fingerprint Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2018-12853 October 2018...

Code injection

An issue was discovered on Samsung mobile devices with N7.x and O8.x Exynos chipsets software. There is an invalid free in the fingerprint Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2018-12853 October 2018...

CVE-2018-21051

An issue was discovered on Samsung mobile devices with N7.x and O8.x Exynos chipsets software. There is an invalid free in the fingerprint Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2018-12853 October 2018...

CVE-2020-11600

An issue was discovered on Samsung mobile devices with Q10.0 software. There is arbitrary code execution in the Fingerprint Trustlet via a memory overwrite. The Samsung IDs are SVE-2019-16587, SVE-2019-16588, SVE-2019-16589 April 2020...

CVE-2020-11600

An issue was discovered on Samsung mobile devices with Q10.0 software. There is arbitrary code execution in the Fingerprint Trustlet via a memory overwrite. The Samsung IDs are SVE-2019-16587, SVE-2019-16588, SVE-2019-16589 April 2020...

Code injection

An issue was discovered on Samsung mobile devices with Q10.0 software. There is arbitrary code execution in the Fingerprint Trustlet via a memory overwrite. The Samsung IDs are SVE-2019-16587, SVE-2019-16588, SVE-2019-16589 April 2020...

CVE-2020-11600

An issue was discovered on Samsung mobile devices with Q10.0 software. There is arbitrary code execution in the Fingerprint Trustlet via a memory overwrite. The Samsung IDs are SVE-2019-16587, SVE-2019-16588, SVE-2019-16589 April 2020...

CVE-2020-11600

Samsung mobile devices with Q(10.0) software are affected by CVE-2020-11600, where an arbitrary code execution in the Fingerprint Trustlet can occur via a memory overwrite (SVE-2019-16587, SVE-2019-16588, SVE-2019-16589). The provided sources confirm the vulnerability vector and impact but do not...

'Fake Fingerprints' Bypass Scanners with 3D Printing

New research has found that it’s possible to use 3D printing technology to create “fake fingerprints” that can bypass most fingerprint scanners used by popular devices. But, creating the attack remains costly and time-consuming. Researchers with Cisco Talos created different threat models that us...

A Cheap 3D Printer Can Trick Smartphone Fingerprint Locks

With a budget of just $2,000, researchers could fool biometric scanners 80 percent of the time...

CVE-2016-11044

An issue was discovered on Samsung mobile devices with L5.0/5.1 and M6.0 with Fingerprint support software. The check of an application's signature can be bypassed during installation. The Samsung ID is SVE-2016-5923 June 2016...