Saturday, December 2, 2023

CISA Warns that Hackers Actively Exploiting Samsung Vulnerability

CISA has issued a recent warning regarding a security flaw that impacts Samsung devices, enabling attackers to circumvent Android’s address space layout randomization (ASLR) protection during targeted attacks.

ASLR serves as a crucial security feature in Android, ensuring that the memory addresses where essential app and operating system components are loaded into the device’s memory undergo randomization.

Introducing this mechanism significantly enhances the complexity for potential attackers attempting to exploit memory-related vulnerabilities, thereby heightening the challenge of executing successful attacks such as buffer overflow, return-oriented programming, or other exploits that rely on manipulating memory.

Samsung mobile devices that are operating on the following versions of Android OS are susceptible to the vulnerability (CVE-2023-21492), which arises from the inadvertent inclusion of sensitive data in log files:-

  • Android 11
  • Android 12
  • Android 13

Local attackers possessing elevated privileges can leverage the disclosed information to carry out an ASLR bypass, consequently facilitating the exploitation of the vulnerabilities in memory management.

Flaw Profile

  • CVE ID: CVE-2023-21492
  • Description: Kernel pointers are printed in the log file before SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
  • Summary: It’s a kernel pointers exposure in a log file
  • Severity: Moderate
  • Base Score: 4.4
  • Reported on: January 17, 2023
  • Disclosure status: Privately disclosed

As part of the latest security updates, Samsung has effectively resolved this matter by implementing measures that prevent kernel pointers from being logged in future occurrences.

According to the May 2023 Security Maintenance Release (SMR) advisory, Samsung has acknowledged being informed about an exploit targeting this particular issue in the wild.

Although Samsung did not disclose specific information regarding the exploitation of CVE-2023-21492, it is important to note that during highly targeted cyberattacks, security vulnerabilities are frequently exploited within the complicated chain of exploits.

These campaigns employed chains of exploits targeting the following platforms’ vulnerabilities to deploy commercially-driven spyware:-

  • Android
  • iOS
  • Chrome

While apart from this, there are two separate attack campaigns were identified and disclosed by the security analysts at Google’s Threat Analysis Group (TAG) and Amnesty International in March.

Immediately patch by June 9

Following CISA’s recent inclusion of the CVE-2023-21492 vulnerability in its list of Known Exploited Vulnerabilities, U.S. Federal Civilian Executive Branch Agencies (FCEB) have been granted a three-week timeframe until June 9 to fortify their Samsung Android devices against potential attacks exploiting this security flaw.

In accordance with BOD 22-01, federal agencies must patch all flaws added to CISA’s KEV list by the deadline of June 9, 2023.

The cybersecurity agency’s list of bugs exploited in attacks is valuable for U.S. federal agencies and private companies. 

Private organizations can significantly reduce their risk of being successfully attacked by prioritizing the remediation of vulnerabilities on this list, along with federal agencies.

Frequent vulnerabilities serve as prime targets for cyber attackers, exposing the federal enterprise to substantial risks.

Shut Down Phishing Attacks with Device Posture Security – Download Free E-Book


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles