Samsung Exynos vulnerabilities

A vulnerability was discovered in the L2 layer of Samsung Mobile Processor, Wearable Processor, and Modem Exynos models 980, 990, 850, 1080, 2400, 1580, 9110, W920, W930, Modem 5123, and Modem 5400. Incorrect handling of RRC packets leads to a Denial of Service.

A vulnerability was discovered in the Camera of Samsung Mobile and Wearable Processors Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Improper validation of user-space input in the issimian device driver leads to information disclosure and denial of service.

In Samsung Exynos mobile processors, Wearable Processor, and Modem, a stack-based buffer overflow vulnerability exists while parsing SMS RP-DATA messages. An attacker can send a crafted SMS message, causing a buffer overflow and potentially arbitrary code execution.

In Samsung Mobile Processor, Wearable Processor, and Modem Exynos (including 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400), an issue was discovered in L2. Incorrect handling of LTE MAC packets containing many MAC Control Elements (CEs) leads to baseband crashes.

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds writes via malformed NAS packets.

An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (including Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920, Modem 5123, Modem 5300, and Auto T5123). In the Shannon SM Task, improper handling of a loop with an unreachable exit condition cannot guarantee termination of a required service via a malformed SM message.

An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RRC Reconfiguration message.

An untrusted pointer dereference vulnerability was discovered in the camera component of Samsung Exynos 1580 and 2500 processors. Sending a malformed message to the camera driver causes limited information disclosure or denial of service.

A stack-based buffer overflow was discovered in the camera of Samsung Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 mobile processors. It occurs when a malformed message is sent to the camera driver, causing a denial of service.

A vulnerability was found in the CustOS driver of Samsung Exynos 1580. Requesting oversized shared memory from the custos_iwc device enables out-of-bounds read and write, potentially leading to memory corruption or information leakage.

A vulnerability was discovered in Samsung Exynos 1330, 1380, 1480, and 2400 mobile processors. An out-of-bounds memory access in the camera GDC driver may lead to kernel memory corruption under certain conditions.

An out-of-bounds write exists in the DPU driver of Samsung Exynos processors (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, 2600) due to missing input length validation in color mode LUT parsing. This leads to kernel memory corruption and potential privilege escalation.

A double-free vulnerability exists in the Samsung Exynos DPU driver (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, 2600) due to improper pointer management during DMA buffer reallocation. This leads to kernel memory corruption and a potential use-after-free.

A double-free vulnerability was discovered in the MFC module of Samsung Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000 processors. The flaw in the Exynos MFC encoder driver, caused by improper cleanup of dma_buf references during error handling, leads to kernel memory corruption and potential arbitrary code execution.

A heap overflow exists in the Exynos DRM HDR driver of Samsung Exynos processors (1280, 2200, 1380) due to improper buffer size validation. This leads to kernel memory corruption and a system crash.

A use-after-free exists in the Exynos DRM HDR driver of Samsung Exynos processors (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, 2600) due to improper cleanup upon vmap failure. This leads to a kernel crash.

An issue was discovered in the DPU of Samsung Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. A TOCTOU race condition in the Exynos DRM HDR driver leads to a heap overflow, causing a kernel crash.

A lack of input validation in Samsung Exynos processors and modems leads to a Denial of Service (DoS).

A vulnerability in the NAS (Non-Access Stratum) layer of Samsung Exynos processors and modems allows a Denial of Service attack via improper handling of a DL NAS Transport packet. The issue affects a wide range of mobile, wearable, and modem chipsets.

In Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580, a vulnerability was found related to incorrect handling of NL80211 vendor commands, leading to a buffer overflow during IOCTL message processing.

An invalid kernel address dereference in the issimian device driver in Samsung Exynos processors (models 1330, 1380, 1480, 2400, 1580, 2500) leads to a denial of service.