ZDI-CAN-7477: (Pwn2Own) Samsung Galaxy S9 GameServiceReceiver Unsafe Updates Validation Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the GameServiceReceiver update mechanism. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-7477?
The severity of ZDI-CAN-7477 is high due to its ability to allow remote code execution without authentication.
How do I fix ZDI-CAN-7477?
To fix ZDI-CAN-7477, ensure that your Samsung Galaxy S9 is updated to the latest firmware version provided by Samsung.
Who is affected by ZDI-CAN-7477?
ZDI-CAN-7477 affects all users of Samsung Galaxy S9 devices running vulnerable versions of the GameServiceReceiver update mechanism.
Can ZDI-CAN-7477 be exploited remotely?
Yes, ZDI-CAN-7477 can be exploited remotely, allowing attackers to execute arbitrary code without user interaction.
What components are involved in ZDI-CAN-7477?
ZDI-CAN-7477 involves the handling of the GameServiceReceiver update mechanism in affected Samsung Galaxy S9 devices.