Lucene search

[email protected]CVE-2024-27374

HistoryJun 05, 2024 - 7:15 p.m.

CVE-2024-27374

2024-06-0519:15:13

CWE-787

[email protected]

web.nvd.nist.gov

cve-2024-27374

input validation check

userspace

heap overwrite

nvd

samsung mobile processor

exynos 980

exynos 850

exynos 1280

exynos 1380

exynos 1330

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

Low

0 Low

EPSS

Percentile

0.0%

JSON

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_publish_get_nl_params(), there is no input validation check on hal_req->service_specific_info_len coming from userspace, which can lead to a heap overwrite.

Affected configurations

NVD

Node

samsungexynos_980_firmwareMatch-

AND

samsungexynos_980Match-

Node

samsungexynos_850_firmwareMatch-

AND

samsungexynos_850Match-

Node

samsungexynos_1280_firmwareMatch-

AND

samsungexynos_1280Match-

Node

samsungexynos_1380_firmwareMatch-

AND

samsungexynos_1380Match-

Node

samsungexynos_1330_firmwareMatch-

AND

samsungexynos_1330Match-

CPENameOperatorVersion
samsung:exynos_980_firmwaresamsung exynos 980 firmwareeq-

CPE	Name	Operator	Version
samsung:exynos_980_firmware	samsung exynos 980 firmware	eq	-

References

semiconductor.samsung.com/support/quality-support/product-security-updates/

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

Low

0 Low

EPSS

Percentile

0.0%

JSON

Related for CVE-2024-27374

cvelist1 vulnrichment1 nvd1