CVE-2018-21051

Vulnerability

The vulnerability is an invalid free in the fingerprint Trustlet on Samsung mobile devices with Exynos chipsets running Android N (7.x) and O (8.x). The flaw allows an attacker to trigger a memory corruption condition, leading to arbitrary code execution.

Exploitation

Available references do not specify the exact attack vector or required conditions. However, since it involves the fingerprint Trustlet, likely exploitation requires local access or ability to interact with the fingerprint sensor. The invalid free occurs during processing of certain inputs, potentially enabling a local attacker to execute arbitrary code in the context of the Trustlet.

Impact

Successful exploitation can lead to arbitrary code execution within the fingerprint Trustlet, which may allow an attacker to compromise the security of the device, potentially gaining elevated privileges and access to sensitive data such as biometric information.

Mitigation

Samsung addressed this issue in the October 2018 security update under SVE-2018-12853. Users are advised to update their device to the latest firmware via Samsung's regular security updates [1]. No workaround is available besides applying the patch.