CVE-2024-27385

A vulnerability was discovered in the slsi_handle_nan_rx_event_log_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 related to no input validation check on tag_len for rx coming from userspace, which can lead to heap overwrite.

Score

CVSS 3.1 6.7 Medium

Status

Analyzed - cve@mitre.org

Published

2024-07-09

Last modified

2024-08-02

Weaknesses

CWE-20

Affected products

• Exynos 1380 Firmware (Samsung)
• Exynos 1480 Firmware (Samsung)

References

• https://semiconductor.samsung.com/support/quality-support/product-security-updates/
• https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-27385/