CVE-2024-27382
📋 TL;DR
This vulnerability in Samsung Exynos mobile processors allows attackers to read heap memory beyond allocated boundaries due to missing input validation in the slsi_send_action_frame() function. It affects devices using Exynos 980, 850, 1280, 1380, and 1330 chipsets. This could potentially expose sensitive information from device memory.
💻 Affected Systems
- Samsung Mobile Processor Exynos 980
- Samsung Mobile Processor Exynos 850
- Samsung Mobile Processor Exynos 1280
- Samsung Mobile Processor Exynos 1380
- Samsung Mobile Processor Exynos 1330
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure of sensitive data from device memory, potentially including cryptographic keys, authentication tokens, or other protected information.
Likely Case
Limited information disclosure of adjacent heap memory, potentially exposing non-sensitive application data or causing application instability.
If Mitigated
No impact if proper input validation is implemented or if the vulnerable function is not accessible to attackers.
🎯 Exploit Status
Exploitation requires ability to send crafted action frames to the vulnerable function, which typically requires local access or specific permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Samsung security updates for specific device models
Vendor Advisory: https://semiconductor.samsung.com/support/quality-support/product-security-updates/
Restart Required: Yes
Instructions:
1. Check for security updates from device manufacturer. 2. Apply available firmware updates. 3. Reboot device after update installation.
🔧 Temporary Workarounds
Restrict access to wireless interfaces
androidLimit which applications can access Wi-Fi/Bluetooth interfaces to reduce attack surface
🧯 If You Can't Patch
- Isolate affected devices from untrusted networks
- Implement application allowlisting to prevent unauthorized apps from accessing wireless interfaces
🔍 How to Verify
Check if Vulnerable:
Check device specifications for Exynos 980, 850, 1280, 1380, or 1330 processor and verify no security patches have been appliedCheck Version:
adb shell getprop ro.build.fingerprint (for Android devices)Verify Fix Applied:
Check device security patch level in Settings > About Phone > Software Information📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- Driver crash reports
- Memory access violation logs
Network Indicators:
- Unusual action frame patterns
- Malformed wireless packets
SIEM Query:
Search for kernel or driver crash events related to slsi_send_action_frame or wireless drivers