CVE-2024-27376: Input Validation
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsinansubscribegetnlparams(), there is no input validation check on halreq->rxmatchfilterlen coming from userspace, which can lead to a heap overwrite.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27376?
CVE-2024-27376 is classified as a high-severity vulnerability due to the potential for heap overwrite leading to exploitation.
How do I fix CVE-2024-27376?
To fix CVE-2024-27376, ensure you update your Samsung Exynos firmware to the latest version provided by Samsung.
What devices are affected by CVE-2024-27376?
CVE-2024-27376 affects Samsung Mobile Processors Exynos 980, 850, 1280, 1380, and 1330.
What are the risks associated with CVE-2024-27376?
The risks associated with CVE-2024-27376 include potential system crashes and the possibility of remote code execution by an attacker.
What specific function is responsible for the vulnerability in CVE-2024-27376?
The vulnerability in CVE-2024-27376 arises from the function slsi_nan_subscribe_get_nl_params(), which lacks input validation.