CVE-2024-48883
What it is
An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, and Modem 5300. The UE incorrectly handles a malformed uplink scheduling message, resulting in an information leak of the UE.
At a glance
- Exploitability
- Can be exploited with physical access without logging in. Limited direct impact.
- Exploit odds
- 0.2% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Details
- Published
- Last modified
- Exploit probability
- 0.2% · EPSS, next 30 days
- Weakness
- CWE-922
- Record status
- Analyzed
Affected
- Samsung Exynos Modem 5123 Firmware
- Samsung Exynos Modem 5300 Firmware
- Samsung Exynos 9820 Firmware
- Samsung Exynos 9825 Firmware
- Samsung Exynos 980 Firmware
- Samsung Exynos 990 Firmware
- Samsung Exynos 850 Firmware
- Samsung Exynos 1080 Firmware
Attack profile CVSS 3.1 · 4.3
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix and advisories
- https://semiconductor.samsung.com/support/quality-support/product-security-updates/
- https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-48883/