CVE-2024-27371

MEDIUM

6.7

Descricao

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl_params(), there is no input validation check on hal_req->service_specific_info_len coming from userspace, which can lead to a heap overwrite.

Detalhes CVE

Pontuacao CVSS v3.16.7

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueLOCAL

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado6/5/2024

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

samsung:exynos_1280samsung:exynos_1280_firmwaresamsung:exynos_1330samsung:exynos_1330_firmwaresamsung:exynos_1380samsung:exynos_1380_firmwaresamsung:exynos_850samsung:exynos_850_firmwaresamsung:exynos_980samsung:exynos_980_firmware

Fraquezas (CWE)

CWE-787CWE-1288

Referencias

https://semiconductor.samsung.com/support/quality-support/product-security-updates/(cve@mitre.org)

https://semiconductor.samsung.com/support/quality-support/product-security-updates/(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.