CVE-2025-58345
📋 TL;DR
This vulnerability in Samsung Exynos Wi-Fi drivers allows attackers to cause kernel memory exhaustion through unbounded memory allocation when writing to /proc/driver/unifi0/ap_certif_11ax_mode. This affects Samsung mobile and wearable devices using the listed Exynos processors, potentially leading to denial of service or system instability.
💻 Affected Systems
- Samsung Mobile Processor Exynos 980
- Samsung Mobile Processor Exynos 850
- Samsung Mobile Processor Exynos 1080
- Samsung Mobile Processor Exynos 1280
- Samsung Mobile Processor Exynos 1330
- Samsung Mobile Processor Exynos 1380
- Samsung Mobile Processor Exynos 1480
- Samsung Mobile Processor Exynos 1580
- Samsung Wearable Processor Exynos W920
- Samsung Wearable Processor Exynos W930
- Samsung Wearable Processor Exynos W1000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or kernel panic requiring hard reboot, potentially causing data loss or corruption.
Likely Case
Device becomes unresponsive or experiences performance degradation due to memory exhaustion, requiring restart.
If Mitigated
Limited impact with proper access controls preventing unauthorized write operations to the vulnerable interface.
🎯 Exploit Status
Exploitation requires write access to the specific /proc interface, which typically requires elevated privileges or a malicious app with appropriate permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Samsung security updates for specific device models and patch levels
Vendor Advisory: https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-58345/
Restart Required: Yes
Instructions:
1. Check for security updates in device settings. 2. Apply the latest Samsung security patch for your device model. 3. Reboot the device after installation. 4. Verify the patch level in device information.
🔧 Temporary Workarounds
Restrict /proc access
linuxLimit access to the vulnerable /proc interface using file permissions or SELinux policies
chmod 600 /proc/driver/unifi0/ap_certif_11ax_mode
chown root:root /proc/driver/unifi0/ap_certif_11ax_mode
🧯 If You Can't Patch
- Monitor device performance for memory exhaustion symptoms and restart if issues occur
- Limit installation of untrusted applications that could potentially exploit this vulnerability
🔍 How to Verify
Check if Vulnerable:
Check if /proc/driver/unifi0/ap_certif_11ax_mode exists and is writable on affected Exynos devicesCheck Version:
getprop ro.build.version.security_patchVerify Fix Applied:
Check device security patch level in Settings > About phone > Software information📡 Detection & Monitoring
Log Indicators:
- Kernel logs showing memory allocation failures or OOM killer activity
- System logs showing abnormal /proc access patterns
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
source="kernel" AND ("Out of memory" OR "oom_kill" OR "allocation failure") AND process="unifi"