CVE-2023-29089

Vulnerability

A memory corruption vulnerability exists in the Shannon baseband firmware of Samsung Exynos processors when decoding SIP multipart messages. The issue stems from insufficient parameter validation, allowing a negative size value to be passed to a memcpy operation. Affected products include Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123 [1].

Exploitation

An unauthenticated attacker can send a specially crafted SIP multipart message over the air to the target device's baseband. The malformed message triggers a negative-size memcpy, leading to an out-of-bounds read or write condition [2]. No user interaction is required.

Impact

Successful exploitation could allow an attacker to achieve remote code execution or cause a denial of service at the baseband level. This could compromise the device's cellular communication and potentially provide a foothold for further attacks on the application processor.

Mitigation

Samsung has addressed this vulnerability in a security update. Users should apply the latest firmware updates provided by Samsung for their devices [1]. No workaround is available; updating to the patched version is the only mitigation.