Product Security Update

Product Security Update

• January 2024

  Improper privilege control for the named pipe in Samsung Magician PC Software (for Windows) allows a local attacker to read privileged data.

  CVE ID	CVE-2024-23769
  Title	Misconfigured Permissions on Named Pipe
  Affected Product	Samsung Magician Software for Windows
  Affected Version	8.0.0
  Severity	High (7.3)
  Reported Date	2023-10-30
  Patched Version	8.0.1
  Acknowledgment	Masahiro Iida

• December 2023

  • Information Disclosure in the Bootloader

    CVE ID	CVE-2023-43122
    Title	Memory Corruption in the Bootloader
    Affected Product	Mobile Processor, Wearable Processor
    Affected Version	Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920
    Severity	Medium (4.8)
    Reported Date	2023. 7. 28
    Patched Version	※ Not affect all vendor's product, please contact your vendor.
    Acknowledgment	Christopher Wade

  • A race condition causes unintended modifications of values within certain areas.

    CVE ID	CVE-2023-45864
    Title	TOCTOU in the Exynos NPU
    Affected Product	Mobile Processor
    Affected Version	Exynos 9820, Exynos 980, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380
    Severity	Medium (4.1)
    Reported Date	2023. 6. 10
    Patched Version	※ Not affect all vendor's product, please contact your vendor.
    Acknowledgment	Ye Zhang

  • A race condition can cause unexpected termination of a system.

    CVE ID	CVE-2023-42483
    Title	TOCTOU in the Exynos NPU
    Affected Product	Mobile Processor
    Affected Version	Exynos 9820, Exynos 980, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380
    Severity	Medium (6.4)
    Reported Date	2023. 5. 15
    Patched Version	※ Not affect all vendor's product, please contact your vendor.
    Acknowledgment	Ye Zhang

• November 2023

  • Buffer copy without checking size of input can cause abnormal termination of a mobile phone.

    CVE ID	CVE-2023-41112
    Title	Denial of Service in Samsung Shannon Baseband
    Affected Product	Mobile Processor, Wearable Processor, Automotive Processor, Modem
    Affected Version	Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123
    Severity	High (7.1)
    Reported Date	2023. 4. 1
    Patched Version	※ Not affect all vendor's product, please contact your vendor.
    Acknowledgment	Daniel Komaromy

  • Improper handling of length parameter inconsistency can cause abnormal termination of a mobile phone.

    CVE ID	CVE-2023-41111
    Title	Memory Corruption in Samsung Shannon Baseband
    Affected Product	Mobile Processor, Wearable Processor, Automotive Processor, Modem
    Affected Version	Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123
    Severity	High (7.1)
    Reported Date	2023. 4. 1
    Patched Version	※ Not affect all vendor's product, please contact your vendor.
    Acknowledgment	Daniel Komaromy

• September 2023

  • Use After Free vulnerability in the GPU instance may lead to Local Privilege Escalation (LPE)

    CVE ID	CVE-2023-42482
    Title	Use After Free in Samsung GPU
    Affected Product	Mobile Processor
    Affected Version	Exynos 2200
    Severity	High (7.8)
    Reported Date	2023. 6. 13
    Patched Version	※ Not affect all vendor's product, please contact your vendor.
    Acknowledgment	APVI/Google (Xingyu Jin)

  • Double Free vulnerability in the GPU instance may lead to Local Privilege Escalation (LPE)

    CVE ID	CVE-2023-41911
    Title	Double Free in Samsung GPU
    Affected Product	Mobile Processor
    Affected Version	Exynos 2200
    Severity	High (7.8)
    Reported Date	2023. 6. 13
    Patched Version	※ Not affect all vendor's product, please contact your vendor.
    Acknowledgment	APVI/Google (Xingyu Jin)

  • A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software could allow a local attacker to escalate privileges. (An attacker must already have user privileges on Windows to exploit this vulnerability.)

    CVE ID	CVE-2023-41929
    Title	DLL hijacking vulnerability
    Affected Product	Samsung Memory Card & UFD Authentication Utility PC Software
    Affected Version	Below 1.0.1 version
    Severity	7.3 (High)
    Reported Date	2023. 6. 29
    Patched Version	1.0.2

  • Missing validation of null pointer can cause abnormal termination.

    CVE ID	CVE-2023-37368
    Title	An invalid pointer dereference in mobility management processing of Shannon BaseBand
    Affected Product	Exynos Mobile Processor, Automotive Processor, and Modem
    Affected Chipset	Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123
    Severity	5.9 (Medium)
    Reported Date	2023. 4. 28
    Patched Version	※ Not affect all vendor’s product, please contact your vendor.

  • Improperly implemented security check for standard can disallow desired services for a while.

    CVE ID	CVE-2023-37367
    Title	Improper authorization of 5G NAS messages
    Affected Product	Exynos Mobile Processor, Automotive Processor, and Modem
    Affected Chipset	Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123
    Severity	5.3 (Medium)
    Reported Date	2023. 4. 28
    Patched Version	※ Not affect all vendor’s product, please contact your vendor.

  • Interger overflow at buffer indext can prevent the execution of requested services via a crafted application.

    CVE ID	CVE-2023-40353
    Title	OOB-Read in DSP Kernel Driver
    Affected Product	Exynos Mobile Processor
    Affected Chipset	Exynos 980, Exynos 2100
    Severity	Low (2.0)
    Reported Date	2023. 5. 10
    Patched Version	※ Not affect all vendor’s product, please contact your vendor.
    Acknowledgement	Sunjoo park (grigoritchy) of PKSecurity

  • Improper handling of length parameter inconsistency can cause incorrect packet filtering.

    CVE ID	CVE-2023-37377
    Title	OOB-Read in MBIM driver
    Affected Product	Mobile Processor, Wearable Processor
    Affected Chipset	Exynos 980, Exynos 850, Exynos 2100, Exynos W920, Exynos 1080
    Severity	Low (2.0)
    Reported Date	2023. 5. 26
    Patched Version	※ Not affect all vendor’s product, please contact your vendor.
    Acknowledgement	Sunjoo park (grigoritchy) of PKSecurity

• August 2023

  • Improper handling of length parameter inconsistency can cause infinite loop.

    CVE ID	CVE-2023-36481
    Title	Buffer copy without checking input size during PPP communication in Shannon BaseBand
    Affected Product	Mobile Processor, Wearable Processor
    Affected Chipset	Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980 , Exynos 850 , Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920
    Severity	5.3 (Medium)
    Reported Date	2023. 4. 13
    Patched Version	※ Not affect all vendor's product, please contact your vendor

  • Improper handling of loop with unreachable exit condition cannot guarantee the termination of a required service.

    CVE ID	CVE-2023-37366
    Title	Improper handling of loop with unreachable exit condition during mobility management in Shannon BaseBand
    Affected Product	Exynos Mobile Processor, Automotive Processor, and Modem
    Affected Chipset	Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123
    Severity	5.9 (Medium)
    Reported Date	2023. 4. 28
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Integer overflow can bypass detection of error cases via a crafted application.

    CVE ID	CVE-2023-40218
    Title	Integer Overflow Vulnerability in Exynos NPU Kernel Driver
    Affected Product	Exynos Mobile Processor
    Affected Chipset	Exynos 9820, Exynos 980, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380
    Severity	Low (2.0)
    Reported Date	2023. 4. 28
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

• July 2023

  Buffer copy without checking its input size can cause an NFC service to restart.

  CVE ID	CVE-2023-36482
  Title	Buffer copy without checking its input size in NFC Communication inferface
  Affected Product	NFC
  Affected Chipset	S3NRN4V, S3NSN4V, S3NSEN4, SEN82AB, S3NRN82
  Severity	2.0 (Low)
  Reported Date	2023-04-27
  Patched Version	※ Not affect all vendor's product, please contact your vendor.

• May 2023

  • Binding wrong resource can occur due to improper handling of parameters while binding network interface

    CVE ID	CVE-2023-29092
    Title	Improper handling of parameters while binding network interface
    Affected Product	Exynos Mobile Processor and Modem
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080
    Severity	3.1 (Low)
    Reported Date	2023-02-07
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Incorrect resource transfer between spheres can cause unintended querying of SIM status via a crafted application.

    CVE ID	CVE-2023-31114
    Title	Incorrect resource transfer between Spheres while broadcasting SIM state in Shannon IMS
    Affected Product	Shannon RCS
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300
    Severity	2.8 (Low)
    Reported Date	2023-02-25
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Incorrect resource transfer between spheres can cause changes to the activation mode of RCS via a crafted application.

    CVE ID	CVE-2023-31115
    Title	Incorrect resource transfer between Spheres while broadcasting mode information in Shannon RCS
    Affected Product	Shannon RCS
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300
    Severity	2.8 (Low)
    Reported Date	2023-02-25
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Incorrect Default Permission can cause unintended querying of RCS capability via a crafted application.

    CVE ID	CVE-2023-31116
    Title	Improper default permission on contact capability in Shannon RCS
    Affected Product	Shannon RCS
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300
    Severity	2.8 (Low)
    Reported Date	2023-02-25
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

• April 2023

  • Integer Overflow in IPv4 fragments handling can occur due to insufficient parameter validation when reassembling IPv4 fragments.

    CVE ID	CVE-2023-28613
    Title	Integer overflow when reassembling IPv4 fragments
    Affected Product	Exynos Mobile Processor and Baseband Modem Processor
    Affected Chipset	Exynos 1280, Exynos 2200, Exynos Modem 5300
    Severity	6.8 (Medium)
    Reported Date	2023-01-25
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Memory corruption can occur due to insufficient parameter validation while decoding SIP URI.

    CVE ID	CVE-2023-29091
    Title	Memory corruption when decoding SIP URI
    Affected Product	Exynos Mobile Processor, Automotive Processor and Modem
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
    Severity	6.8 (Medium)
    Reported Date	2023-01-16
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Memory corruption can occur due to insufficient parameter validation while decoding SIP Via header.

    CVE ID	CVE-2023-29090
    Title	Memory corruption when decoding SIP Via header
    Affected Product	Exynos Mobile Processor, Automotive Processor and Modem
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
    Severity	6.8 (Medium)
    Reported Date	2023-01-23
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Memory corruption can occur due to insufficient parameter validation while decoding SIP status line.

    CVE ID	CVE-2023-29085
    Title	Memory corruption when decoding SIP status line
    Affected Product	Exynos Mobile Processor, Automotive Processor and Modem
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
    Severity	6.8 (Medium)
    Reported Date	2023-01-23
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Memory corruption can occur due to insufficient parameter validation while decoding SIP Session-Expires header.

    CVE ID	CVE-2023-29088
    Title	Memory corruption when decoding SIP Session-Expires header
    Affected Product	Exynos Mobile Processor, Automotive Processor and Modem
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
    Severity	6.8 (Medium)
    Reported Date	2023-01-23
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Memory corruption can occur due to insufficient parameter validation while decoding SIP Retry-After header.

    CVE ID	CVE-2023-29087
    Title	Memory corruption when decoding SIP Retry-After header
    Affected Product	Exynos Mobile Processor, Automotive Processor and Modem
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
    Severity	6.8 (Medium)
    Reported Date	2023-01-27
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Memory corruption can occur due to insufficient parameter validation while decoding SIP Min-SE header.

    CVE ID	CVE-2023-29086
    Title	Memory corruption when decoding SIP Min-SE header
    Affected Product	Exynos Mobile Processor, Automotive Processor and Modem
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
    Severity	6.8 (Medium)
    Reported Date	2023-01-27
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Memory corruption can occur due to insufficient parameter validation while decoding SIP multipart messages.

    CVE ID	CVE-2023-29089
    Title	Out of bound read when decoding SIP multipart messages
    Affected Product	Exynos Mobile Processor, Automotive Processor and Modem
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
    Severity	6.8 (Medium)
    Reported Date	2023-01-27
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

• March 2023

  • Heap buffer overflow in 5G MM message codec can occur due to insufficient parameter validation when decoding Emergency number list.

    CVE ID	CVE-2023-26072
    Title	Shannon Baseband: Heap buffer overflow in NrmmMsgCodec when decoding Emergency number list
    Affected Product	Samsung Mobile Chipset and Baseband Modem Chipset
    Affected Chipset	Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123
    Severity	7.6 (High)
    Reported Date	15-Dec-22
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Heap buffer overflow in 5G MM message codec can occur due to insufficient parameter validation when decoding Extended emergency number list.

    CVE ID	CVE-2023-26073
    Title	Shannon Baseband: Heap buffer overflow in NrmmMsgCodec when decoding Extended emergency number list
    Affected Product	Samsung Mobile Chipset and Baseband Modem Chipset
    Affected Chipset	Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123
    Severity	7.6 (High)
    Reported Date	15-Dec-22
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Heap buffer overflow in 5G MM message codec can occur due to insufficient parameter validation when decoding Operator-defined access category definitions.

    CVE ID	CVE-2023-26074
    Title	Shannon Baseband: Heap buffer overflow in NrmmMsgCodec when decoding Operator-defined access category definitions
    Affected Product	Samsung Mobile Chipset and Baseband Modem Chipset
    Affected Chipset	Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123
    Severity	7.6 (High)
    Reported Date	15-Dec-22
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Intra-object overflow in 5G MM message codec can occur due to insufficient parameter validation when decoding Service Area List.

    CVE ID	CVE-2023-26075
    Title	Shannon Baseband: Intra-object overflow in NrmmMsgCodec when decoding Service Area List
    Affected Product	Samsung Mobile Chipset and Baseband Modem Chipset
    Affected Chipset	Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123
    Severity	7.6 (High)
    Reported Date	15-Dec-22
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Intra-object overflow in 5G SM message codec can occur due to insufficient parameter validation when decoding reserved options.

    CVE ID	CVE-2023-26076
    Title	Shannon Baseband: Intra-object overflow in NrSmPcoCodec when decoding reserved options
    Affected Product	Samsung Mobile Chipset and Baseband Modem Chipset
    Affected Chipset	Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123
    Severity	7.6 (High)
    Reported Date	20-Dec-22
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Memory corruption can occur when processing Session Desciption Negotiation for Video Resolution Attribute.

    CVE ID	CVE-2023-26496
    Title	Shannon Baseband:Memory corruption when processing Session Desciption Negotiation for Video Resolution Attribute.
    Affected Product	Samsung Baseband Modem Chipset
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
    Severity	8.6 (High)
    Reported Date	19-Dec-2022
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Memory corruption can occur when processing Session Desciption Negotiation for Video Configuration Attribute.

    CVE ID	CVE-2023-26497
    Title	Shannon Baseband: Memory corruption when processing Session Desciption Negotiation for Video Configuration Attribute.
    Affected Product	Samsung Baseband Modem Chipset
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
    Severity	8.6 (High)
    Reported Date	19-Dec-2022
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

  • Memory corruption can occur when processing Session Desciption Negotiation for RCS Chat.

    CVE ID	CVE-2023-26498
    Title	Shannon Baseband: Memory corruption when processing Session Desciption Negotiation for RCS Chat.
    Affected Product	Samsung Baseband Modem Chipset
    Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
    Severity	8.6 (High)
    Reported Date	19-Dec-2022
    Patched Version	※ Not affect all vendor's product, please contact your vendor.

• January 2023

  The baseband software does not properly check the format types of accept-type attribute specified by the SDP, which can lead to a denial of service or code execution in Samsung Baseband Modem. Users can disable WiFi calling and VoLTE to mitigate the impact of this vulnerability.

  CVE ID	CVE-2023-24033
  Title	Shannon Baseband: Memory corruption when processing SDP attribute accept-type
  Affected Product	Samsung Baseband Modem Chipset
  Affected Chipset	Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, Exynos Auto T5123
  Severity	8.6 (High)
  Reported Date	12-Nov-22
  Patched Version	※ Not affect all vendor's product, please contact your vendor.

• March 2022

  A DLL hijacking vulnerability could allow a local attacker to escalate privileges on affected system.
  An attacker must already have user privilege on Windows 7, 10, 11 to exploit this vulnerability.

  CVE ID	CVE-2022-25154
  Title	DLL hijacking vulnerability
  Affected Product	Samsung portable SSD T5 PC software
  Affected Version	Below 1.6.9 version
  Severity	7.3
  Reported Date	09-Jan-2022
  Patched Version	1.6.10