Google Exposes 18 Zero-Day Flaws in Samsung Exynos Chips

The Challenge Zero team at Google printed a new advisory on Thursday, confirming it reported 18 zero-working day vulnerabilities in Exynos Modems produced by Samsung amongst late 2022 and early 2023.

Published by Project Zero head, Tim Willis, the blog article states that 4 of the vulnerabilities (CVE-2023-24033 and 3 other folks that have but to be assigned CVE-IDs) enabled probable attackers to complete internet-to-baseband remote code execution (RCE).

“Those 4 vulnerabilities enable an attacker to remotely compromise a phone at the baseband level with no person interaction and call for only that the attacker know the victim’s phone amount,” Willis spelled out. “With minimal further study and advancement, we consider that qualified attackers would be equipped to swiftly generate an operational exploit to compromise affected products silently and remotely.”

The remaining fourteen flaws would be much less critical since in get to be exploited they require both a destructive cell network operator or an attacker with community obtain to the product to complete RCE. 

In accordance to Samsung’s solution security update webpage, the record of Exynos chipsets impacted by the zero-days contains numerous products. Google approximated that many Samsung smartphones, which include the S22 line, may perhaps be afflicted. Quite a few handheld units by Vivo are also on the list, as are Google Pixel 6 and Pixel 7 sequence and all motor vehicles using the Exynos Automobile T5123 chipset.

Read through extra on Android vulnerabilities below: Google Patches Critical Android Bluetooth Flaw in August Security Bulletin

In the website article, Willis explained that person manufacturers are responsible for repairing the vulnerabilities pointed out above – Google has now patched those affecting Pixel telephones.

“In the meantime, people with impacted devices can secure on their own from the baseband remote code execution vulnerabilities mentioned in this put up by turning off WiFi calling and Voice-around-LTE (VoLTE) in their system options,” reads the article. 

“As constantly, we persuade stop people to update their equipment as shortly as feasible to be certain that they are running the hottest builds that resolve the two disclosed and undisclosed security vulnerabilities.”

The disclosure arrives days immediately after security scientists from Look at Stage Program shared information and facts about a new Android vishing (voice phishing) malware software focusing on victims in South Korea.

Some parts of this article are sourced from:
www.infosecurity-magazine.com