CVE-2024-27386 — MEDIUM (6.7)

Vulnerability Description

A vulnerability was discovered in the slsi_handle_nan_rx_event_log_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 related to no input validation check on tag_len for tx coming from userspace, which can lead to heap overwrite.

CVSS Score

6.7

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Samsung	Exynos 1380 Firmware	-
Samsung	Exynos 1380	-
Samsung	Exynos 1480 Firmware	-
Samsung	Exynos 1480	-

Related Weaknesses (CWE)

CWE-20

References

https://semiconductor.samsung.com/support/quality-support/product-security-updatVendor Advisory
https://semiconductor.samsung.com/support/quality-support/product-security-updatVendor Advisory
https://semiconductor.samsung.com/support/quality-support/product-security-updatVendor Advisory
https://semiconductor.samsung.com/support/quality-support/product-security-updatVendor Advisory

FAQ

What is CVE-2024-27386?

CVE-2024-27386 is a vulnerability with a CVSS score of 6.7 (MEDIUM). A vulnerability was discovered in the slsi_handle_nan_rx_event_log_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 related to no input validation check on tag_len for tx coming fr...

How severe is CVE-2024-27386?

CVE-2024-27386 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-27386?

Check the references section above for vendor advisories and patch information. Affected products include: Samsung Exynos 1380 Firmware, Samsung Exynos 1380, Samsung Exynos 1480 Firmware, Samsung Exynos 1480.