Google Uncovers 18 Severe Security Vulnerabilities in Samsung Exynos Chips

Google is calling focus to a established of critical security flaws in Samsung’s Exynos chips, some of which could be exploited remotely to absolutely compromise a phone with no necessitating any user interaction.

The 18 zero-working day vulnerabilities affect a large variety of Android smartphones from Samsung, Vivo, Google, wearables making use of the Exynos W920 chipset, and cars geared up with the Exynos Vehicle T5123 chipset.

Four of the 18 flaws make it possible for a risk actor to obtain internet-to-baseband remote code execution, Google Project Zero, which described the issues in late 2022 and early 2023, said.

“[The] 4 vulnerabilities make it possible for an attacker to remotely compromise a phone at the baseband amount with no user conversation, and have to have only that the attacker know the victim’s phone variety,” Tim Willis, head of Google Project Zero, explained.

In undertaking so, a threat actor could get entrenched entry to cellular details passing in and out of the qualified system. Supplemental specifics about the bugs have been withheld.

The attacks could possibly audio prohibitive to execute, but, to the contrary, they are effectively in just access of skilled attackers, who can immediately devise an operational exploit to breach impacted products “silently and remotely.”

The remaining 14 flaws are claimed to be not as critical, as it necessitates a rogue cell network insider or an attacker with area obtain to the unit.

WEBINARDiscover the Hidden Risks of 3rd-Bash SaaS Applications

Are you mindful of the pitfalls linked with 3rd-party app obtain to your company’s SaaS apps? Be a part of our webinar to learn about the types of permissions becoming granted and how to minimize risk.

RESERVE YOUR SEAT

Even though Pixel 6 and 7 handsets have presently received a fix as part of March 2023 security updates, patches for other gadgets are predicted to fluctuate based on the manufacturer’s timeline.

Right until then, end users are advisable to swap off Wi-Fi contacting and Voice in excess of LTE (VoLTE) in their product settings to “eliminate the exploitation risk of these vulnerabilities.”

Uncovered this posting intriguing? Stick to us on Twitter  and LinkedIn to browse much more special written content we article.

Some parts of this article are sourced from:
thehackernews.com