CVE-2024-27386: Input Validation

Published Jul 9, 2024

Updated

A vulnerability was discovered in the slsihandlenanrxeventlogind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 related to no input validation check on taglen for tx coming from userspace, which can lead to heap overwrite.

Affected Software

6 affected components

Samsung Mobile Processor Exynos 1380

Samsung Mobile Processor Exynos 1480

All of the following

Samsung Exynos 1380 Firmware

Samsung Exynos 1380

All of the following

Samsung Exynos 1480 Firmware

Samsung Exynos 1480

Event History

Jul 9, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverity

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-27386?

CVE-2024-27386 is considered a high-severity vulnerability due to its potential for heap overwrite.

How do I fix CVE-2024-27386?

To fix CVE-2024-27386, users should apply the latest firmware updates provided by Samsung for the affected Exynos processors.

What are the affected devices for CVE-2024-27386?

CVE-2024-27386 affects Samsung Mobile Processor Exynos 1380 and Exynos 1480.

What does CVE-2024-27386 exploit?

CVE-2024-27386 exploits the lack of input validation checks on tag_len for transactions coming from userspace.

What could be the impact of CVE-2024-27386?

The impact of CVE-2024-27386 could include unauthorized memory access and potential data corruption due to heap overwrite.