CVE-2023-26075

Vulnerability

An intra-object overflow vulnerability exists in the 5G Mobility Management (MM) message codec used by Samsung Exynos chipsets, including Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123 [1][4]. The overflow occurs when decoding the Service Area List due to insufficient parameter validation [1]. This flaw is one of fourteen less severe issues reported by Google Project Zero, which still require either a malicious mobile network operator or an attacker with local access to the device [4].

Exploitation

Exploitation requires either a rogue mobile network operator (MNO) capable of injecting malicious 5G NAS messages into the network, or an attacker with local access to the device [4]. The attacker sends a crafted Service Area List within a 5G MM message; the codec's lack of proper bounds checking when decoding the list allows the overflow to occur [1]. No user interaction is needed beyond the device being attached to the malicious network or the local attacker running the crafted input.

Impact

Successful exploitation leads to an intra-object overflow, which can corrupt memory within the modem's 5G message codec [1]. This corruption may result in denial of service or potentially memory corruption that could be leveraged for further compromise [4]. The attacker does not achieve remote code execution at the baseband level without additional research and development, but the overflow can still affect the availability or integrity of baseband operations.

Mitigation

Samsung Semiconductor has not publicly released a specific firmware patch for CVE-2023-26075 as of the publication date; however, affected device vendors (e.g., Google, Samsung Mobile) typically include baseband fixes in their monthly security updates, such as the March 2023 update for Pixel devices [4]. Users should apply the latest security updates from their device manufacturer. No workaround is available; the vulnerability is inherent to the modem firmware's message parsing logic [1].