CVE-2018-3912: Buffer Overflow
On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. The strcpy call overflows the destination buffer, which has a size of 128 bytes. An attacker can send an arbitrarily long "secretKey" value in order to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3912?
CVE-2018-3912 is classified as a high-severity vulnerability due to its potential for causing a stack buffer overflow.
How do I fix CVE-2018-3912?
To fix CVE-2018-3912, update the Samsung SmartThings Hub STH-ETH-250 devices to a firmware version that addresses this vulnerability.
What devices are affected by CVE-2018-3912?
CVE-2018-3912 specifically affects Samsung SmartThings Hub STH-ETH-250 devices running firmware version 0.20.17.
What exploit can be executed due to CVE-2018-3912?
CVE-2018-3912 can be exploited via a buffer overflow that may allow an attacker to execute arbitrary code.
Is CVE-2018-3912 fixed in later firmware versions?
Yes, later firmware versions for the Samsung SmartThings Hub have patched CVE-2018-3912 to mitigate the vulnerability.