VulnerabilityModified

CVE-2024-27381

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.

MEDIUM 6.0EPSS 0.17%

Does this matter?

Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_ut(), there is no input validation check on len coming from userspace, which can lead to a heap over-read.

CVSS 3.1: 6.0 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
EPSS: 0.17% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-125
Affected: samsung/exynos 980 firmware · samsung/exynos 850 firmware · samsung/exynos 1280 firmware · samsung/exynos 1380 firmware · samsung/exynos 1330 firmware
Source: cve@mitre.org

References

https://semiconductor.samsung.com/support/quality-support/product-security-updates/Vendor Advisory
https://semiconductor.samsung.com/support/quality-support/product-security-updates/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.