The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding active exploitation of medium-severity Samsung device vulnerability, tracked as CVE-2023-21492 and scoring 4.4 on CVSS. The issue impacts Samsung Devices running Android versions 11, 12, and 13.
What Is CVE-2023-21492?
The official technical description says that “Kernel pointers are printed in the log file prior to SMR May-2023 Release 1” thus allowing a privileged local attacker to bypass ASLR. ASLR is a preventative measure that obfuscates executable memory locations against memory corruption and code execution flaws.
According to Samsung, an attacker with privileges can launch an exploitation bypassing the address space layout randomization (ASLR) security protections in said Android versions.
Apparently, the vulnerability was privately discovered on January 17, 2023, and exploit for it existed in the wild since then. There are no further details regarding its abuse, yet earlier records show malicious software has been distributed via Samsung devices in the past.
According to the Google Project Zero research, in August 2020, a remote zero-click MMS attack was carried out, succeeding code execution via two buffer overwrite vulnerabilities in the Quram qmg library (SVE-2020-16747 and SVE-2020-17675).
CISA has added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue, alongside two Cisco IOS bugs (CVE-2004-1464 and CVE-2016-6415), and orders Federal Civilian Executive Branch (FCEB) agencies to patch it before June 9, 2023. The agency has also added seven more flaws to the KEV catalog, the oldest of which is a 13-year-old Linux vulnerability (CVE-2010-3904) leading to unprivileged operation escalation.
Google Project Zero experts confirmed that the Samsung security flaw was discovered by Clement Lecigne of the Google Threat Analysis Group (TAG). This supports the indications of its exploitation for a spyware campaign.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: