CVE-2024-34672
📋 TL;DR
This vulnerability in SamsungVideoPlayer allows local attackers to bypass user isolation and access video files belonging to other users on the same device. It affects Samsung devices running Android 12, 13, and 14 with vulnerable versions of the video player app. The attack requires local access to the device.
💻 Affected Systems
- SamsungVideoPlayer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical or local access could access private video files from other user profiles, potentially exposing sensitive personal content.
Likely Case
Malicious apps or users with local access could view videos from other user accounts on shared or multi-user devices.
If Mitigated
With proper user isolation and app sandboxing, impact is limited to unauthorized file access within the same device.
🎯 Exploit Status
Requires local access to the device. Likely involves crafting malicious input to bypass file access controls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.3.29.1 for Android 12, 7.3.36.1 for Android 13, 7.3.41.230 for Android 14
Vendor Advisory: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=10
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Navigate to Software Update. 3. Check for and install available updates. 4. Restart device after update completes.
🔧 Temporary Workarounds
Disable SamsungVideoPlayer
androidDisable the vulnerable video player app to prevent exploitation
adb shell pm disable-user --user 0 com.sec.android.app.videoplayer
Use alternative video player
androidInstall and use a different video player application
🧯 If You Can't Patch
- Restrict physical access to devices and implement strong device authentication
- Avoid using multi-user profiles on shared devices until patched
🔍 How to Verify
Check if Vulnerable:
Check SamsungVideoPlayer version in Settings > Apps > SamsungVideoPlayer > App infoCheck Version:
adb shell dumpsys package com.sec.android.app.videoplayer | grep versionNameVerify Fix Applied:
Verify SamsungVideoPlayer version is 7.3.29.1 or higher (Android 12), 7.3.36.1 or higher (Android 13), or 7.3.41.230 or higher (Android 14)📡 Detection & Monitoring
Log Indicators:
- Unauthorized file access attempts to /storage/emulated/ directories
- SamsungVideoPlayer process accessing files outside user sandbox
Network Indicators:
- No network indicators - local vulnerability only
SIEM Query:
process_name:"SamsungVideoPlayer" AND file_path:"/storage/emulated/*" AND NOT user_id:current_user