CVE-2024-34598
📋 TL;DR
This vulnerability in Samsung's GoodLock app allows local attackers to bypass security controls and install arbitrary applications from Galaxy Store without user consent. It affects Samsung Galaxy device users who have GoodLock installed. The issue stems from improper component export that enables privilege escalation.
💻 Affected Systems
- Samsung GoodLock
📦 What is this software?
Good Lock by Samsung
⚠️ Risk & Real-World Impact
Worst Case
Attackers could install malicious apps with system-level permissions, potentially leading to complete device compromise, data theft, or installation of persistent malware.
Likely Case
Local attackers install unwanted applications, potentially adware or spyware, leading to privacy violations and degraded device performance.
If Mitigated
With proper app isolation and user awareness, impact is limited to potential installation of unwanted but non-malicious applications.
🎯 Exploit Status
Requires local access to device. Exploitation involves leveraging exported components to trigger arbitrary app installations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.04.95
Vendor Advisory: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07
Restart Required: No
Instructions:
1. Open Galaxy Store 2. Search for GoodLock 3. Update to version 2.2.04.95 or later 4. Verify update completed successfully
🔧 Temporary Workarounds
Disable GoodLock
androidTemporarily disable or uninstall GoodLock until patched
Settings > Apps > GoodLock > Disable/Uninstall
Restrict Unknown Sources
androidEnsure 'Install unknown apps' is disabled for all apps
Settings > Apps > Special app access > Install unknown apps > Disable for all apps
🧯 If You Can't Patch
- Uninstall GoodLock completely from affected devices
- Implement device management policies to restrict app installations
🔍 How to Verify
Check if Vulnerable:
Check GoodLock version in app settings or Galaxy Store. If version is below 2.2.04.95, device is vulnerable.Check Version:
Settings > Apps > GoodLock > App info > VersionVerify Fix Applied:
Confirm GoodLock version is 2.2.04.95 or higher in app info or Galaxy Store.📡 Detection & Monitoring
Log Indicators:
- Unexpected app installations from Galaxy Store
- GoodLock component access attempts
Network Indicators:
- Unusual Galaxy Store download activity
SIEM Query:
AppInstall:source="Galaxy Store" AND NOT user_initiated=true