CVE-2022-39881

Vulnerability

Improper input validation vulnerability in the processing of SIB12 PDU (System Information Block 12 Protocol Data Unit) in Exynos modems prior to the SMR Sep-2022 Release allows a remote attacker to read out-of-bounds memory. Affected versions are all Exynos modem firmware releases before the September 2022 security patch [1].

Exploitation

An attacker in a network position capable of sending specially crafted SIB12 PDU messages to the target device can trigger the vulnerability. No authentication or user interaction is required; the attack can be performed over the air during normal network operations.

Impact

Successful exploitation results in an out-of-bounds memory read, potentially leading to disclosure of sensitive information from the modem's memory. The attacker gains the ability to read memory beyond the intended buffer, which may include cryptographic keys, credentials, or other private data processed by the modem.

Mitigation

The vulnerability is fixed in the Samsung Mobile Security Update (SMR) for September 2022. Users should update their device firmware to the latest available version [1]. No workarounds are provided; installing the security patch is the only mitigation.