CVE-2025-58346
📋 TL;DR
This vulnerability allows attackers to cause kernel memory exhaustion through unbounded memory allocation in the Wi-Fi driver of affected Samsung Exynos processors. Attackers can trigger this by writing a large buffer to /proc/driver/unifi0/send_addts, potentially leading to denial of service. This affects Samsung mobile devices and wearables using the listed Exynos processors.
💻 Affected Systems
- Samsung Mobile Processor Exynos 980
- Samsung Mobile Processor Exynos 850
- Samsung Mobile Processor Exynos 1080
- Samsung Mobile Processor Exynos 1280
- Samsung Mobile Processor Exynos 1330
- Samsung Mobile Processor Exynos 1380
- Samsung Mobile Processor Exynos 1480
- Samsung Mobile Processor Exynos 1580
- Samsung Wearable Processor Exynos W920
- Samsung Wearable Processor Exynos W930
- Samsung Wearable Processor Exynos W1000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or freeze requiring hard reboot, potentially causing data loss and service disruption on affected devices.
Likely Case
Device instability, application crashes, and temporary denial of service until system recovers or reboots.
If Mitigated
Limited impact with proper access controls preventing unauthorized write operations to the vulnerable proc interface.
🎯 Exploit Status
Exploitation requires local access and ability to write to /proc/driver/unifi0/send_addts. No authentication bypass needed if attacker already has appropriate permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Samsung security updates for specific device firmware versions
Vendor Advisory: https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-58346/
Restart Required: Yes
Instructions:
1. Check for available security updates in device settings
2. Apply the latest firmware update from Samsung
3. Reboot device after update installation
4. Verify the patch is applied by checking kernel version or security patch level
🔧 Temporary Workarounds
Restrict proc filesystem access
linuxLimit access to the vulnerable proc entry to prevent unauthorized writes
chmod 600 /proc/driver/unifi0/send_addts
chown root:root /proc/driver/unifi0/send_addts
Disable vulnerable Wi-Fi driver module
linuxUnload the vulnerable Wi-Fi driver if Wi-Fi functionality is not required
rmmod unifi0_driver_module
🧯 If You Can't Patch
- Implement strict application sandboxing to prevent unauthorized access to proc filesystem
- Monitor system logs for unusual write operations to /proc/driver/unifi0/send_addts
🔍 How to Verify
Check if Vulnerable:
Check if /proc/driver/unifi0/send_addts exists and is writable by non-privileged usersCheck Version:
getprop ro.build.fingerprint (Android) or uname -a (kernel version)Verify Fix Applied:
Verify the device has received the latest security patch from Samsung and test write operations to the vulnerable path📡 Detection & Monitoring
Log Indicators:
- Large memory allocation failures in kernel logs
- OOM (Out of Memory) killer events
- Unusual write operations to /proc/driver/unifi0/send_addts
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
source="kernel" AND ("out of memory" OR "OOM" OR "allocation failure") AND process="unifi0"