Threat database

Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid exception handler.

EPSS 0.4%VulnerabilitySamsung Mobile#cwe-287Germany+7

Heap out-of-bounds write vulnerability in bootloader prior to SMR Dec-2023 Release 1 allows a physical attacker to execute arbitrary code.

EPSS 0.4%VulnerabilitySamsung Mobile#cwe-787Germany+9

A use-after-free vulnerability exists in Samsung mobile devices with selected Exynos chipsets. This flaw allows malicious actors to perform unauthorized memory writes and potentially execute arbitrary code on affected devices. The vulnerability has been exploited in the wild. No specific affected software versions or patches have been provided in the available data.

Samsung mobile devices have an improper input validation vulnerability in the modem interface driver. This flaw is a format string bug that can cause a kernel panic. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2021-25487 is an out-of-bounds read vulnerability in Samsung mobile devices affecting the modem interface driver. It arises from insufficient boundary checking in the set_skb_priv() function, which can lead to remote code execution by dereferencing an invalid function pointer. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

Samsung mobile devices have a vulnerability in the DSP driver due to improper boundary checks, which allows out-of-bounds memory access. This flaw has been exploited in the wild. No specific affected versions or patches are provided in the available data.

Samsung mobile devices have a race condition vulnerability in the MFC charger driver that can lead to a use-after-free condition. This vulnerability allows a write operation if the attacker has compromised radio privileges. It has been exploited in the wild and is considered a high severity issue.

Samsung mobile devices have an unspecified vulnerability in the DSP driver that permits attackers to load ELF libraries inside the DSP. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.

Samsung mobile devices have a race condition vulnerability in the MFC charger driver that can lead to a use-after-free condition, enabling a write operation if radio privileges are compromised. This vulnerability has been exploited in the wild.

Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.

KEVEPSS 2.6%VulnerabilitySamsung Mobile#cwe-532Germany+6

Samsung mobile devices have an improper access control vulnerability in the clipboard service that allows untrusted applications to read or write arbitrary files. This vulnerability has been exploited in the wild and was chained with other vulnerabilities (CVE-2021-25369 and CVE-2021-25370). No specific affected versions or patch information is provided.

CVE-2021-25369 is an improper access control vulnerability in Samsung mobile devices using Mali GPUs. It involves the sec_log file, where exploitation allows exposure of sensitive kernel information to userspace. This vulnerability has been exploited in the wild and was chained with CVE-2021-25337 and CVE-2021-25370. No specific affected versions or patch information is provided.

CVE-2021-25370 is a memory corruption vulnerability in Samsung mobile devices using the Mali GPU. It arises from an incorrect handling of file descriptors in the dpu driver, which can cause memory corruption and lead to a kernel panic. This vulnerability has been exploited in the wild and was chained with other vulnerabilities (CVE-2021-25337 and CVE-2021-25369).