CVE-2024-27371
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.7epss 0.2%
exploitation probability
0.2%top 90% of all CVEs
observed exploitation
nono source reports it
In short
A Samsung processor vulnerability fails to validate user input size, allowing attackers to overwrite memory on the device heap. This can crash the system or potentially execute malicious code.
Technical detail
The slsi_nan_followup_get_nl_params() function in Samsung Exynos processors lacks bounds checking on hal_req->service_specific_info_len from userspace, enabling heap buffer overflow. An unprivileged application with network service access can trigger heap memory corruption, potentially leading to information disclosure or code execution.
Summary generated and translated by AI from the official description.
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl_params(), there is no input validation check on hal_req->service_specific_info_len coming from userspace, which can lead to a heap overwrite.
CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:H/S:U/UI:N
Affected products
n/a · n/a