CVE-2018-3917

Vulnerability

The Samsung SmartThings Hub STH-ETH-250 running firmware version 0.20.17 contains a stack-based buffer overflow in the video-core process. The vulnerability lies in how the video-core process extracts fields from the shard table of its SQLite database. Specifically, the strcpy call copies an attacker-controlled region value into a destination buffer of only 16 bytes without checking the length. This allows an attacker to overflow the stack [1].

Exploitation

An attacker must be able to send HTTP requests to the hub's video-core HTTP server. No authentication is required to trigger the vulnerable code path. The attacker simply sends a crafted HTTP request with an arbitrarily long region parameter in the query string. The server then processes this value, overflowing the stack buffer with attacker-controlled data [1].

Impact

Successful exploitation leads to a stack buffer overflow, which can be leveraged for arbitrary code execution. The CVSSv3 score of 7.5 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates a high impact on confidentiality, integrity, and availability, although the attack requires local access (AV:L) and high attack complexity (AC:H) due to the need for precise memory layout knowledge. An attacker can gain full control of the video-core process [1].

Mitigation

Samsung has released a firmware update to address this vulnerability. Users should update their Samsung SmartThings Hub to a firmware version later than 0.20.17. No workarounds are available for this vulnerability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of August 2018 [1].