CVE-2019-6742: (Pwn2Own) Samsung Galaxy S9 GameServiceReceiver Unsafe Updates Validation Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to 1.4.20.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the GameServiceReceiver update mechanism. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7477.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the GameServiceReceiver update mechanism. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Samsung Galaxy S9 vulnerability?
The vulnerability ID for this Samsung Galaxy S9 vulnerability is CVE-2019-6742.
What is the severity of CVE-2019-6742?
The severity of CVE-2019-6742 is critical (score 10).
How can remote attackers exploit CVE-2019-6742?
Remote attackers can exploit CVE-2019-6742 to execute arbitrary code on vulnerable installations of Samsung Galaxy S9.
Is authentication required to exploit CVE-2019-6742?
No, authentication is not required to exploit CVE-2019-6742.
How can I fix this vulnerability?
To fix this vulnerability, update your Samsung Galaxy S9 firmware version to 1.4.20.2 or later.