Thursday, March 28, 2024

CISA Warns that Hackers Actively Exploiting Samsung Vulnerability

CISA has issued a recent warning regarding a security flaw that impacts Samsung devices, enabling attackers to circumvent Android’s address space layout randomization (ASLR) protection during targeted attacks.

ASLR serves as a crucial security feature in Android, ensuring that the memory addresses where essential app and operating system components are loaded into the device’s memory undergo randomization.

Introducing this mechanism significantly enhances the complexity for potential attackers attempting to exploit memory-related vulnerabilities, thereby heightening the challenge of executing successful attacks such as buffer overflow, return-oriented programming, or other exploits that rely on manipulating memory.

Samsung mobile devices that are operating on the following versions of Android OS are susceptible to the vulnerability (CVE-2023-21492), which arises from the inadvertent inclusion of sensitive data in log files:-

  • Android 11
  • Android 12
  • Android 13

Local attackers possessing elevated privileges can leverage the disclosed information to carry out an ASLR bypass, consequently facilitating the exploitation of the vulnerabilities in memory management.

Flaw Profile

  • CVE ID: CVE-2023-21492
  • Description: Kernel pointers are printed in the log file before SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
  • Summary: It’s a kernel pointers exposure in a log file
  • Severity: Moderate
  • Base Score: 4.4
  • Reported on: January 17, 2023
  • Disclosure status: Privately disclosed

As part of the latest security updates, Samsung has effectively resolved this matter by implementing measures that prevent kernel pointers from being logged in future occurrences.

According to the May 2023 Security Maintenance Release (SMR) advisory, Samsung has acknowledged being informed about an exploit targeting this particular issue in the wild.

Although Samsung did not disclose specific information regarding the exploitation of CVE-2023-21492, it is important to note that during highly targeted cyberattacks, security vulnerabilities are frequently exploited within the complicated chain of exploits.

These campaigns employed chains of exploits targeting the following platforms’ vulnerabilities to deploy commercially-driven spyware:-

  • Android
  • iOS
  • Chrome

While apart from this, there are two separate attack campaigns were identified and disclosed by the security analysts at Google’s Threat Analysis Group (TAG) and Amnesty International in March.

Immediately patch by June 9

Following CISA’s recent inclusion of the CVE-2023-21492 vulnerability in its list of Known Exploited Vulnerabilities, U.S. Federal Civilian Executive Branch Agencies (FCEB) have been granted a three-week timeframe until June 9 to fortify their Samsung Android devices against potential attacks exploiting this security flaw.

In accordance with BOD 22-01, federal agencies must patch all flaws added to CISA’s KEV list by the deadline of June 9, 2023.

The cybersecurity agency’s list of bugs exploited in attacks is valuable for U.S. federal agencies and private companies. 

Private organizations can significantly reduce their risk of being successfully attacked by prioritizing the remediation of vulnerabilities on this list, along with federal agencies.

Frequent vulnerabilities serve as prime targets for cyber attackers, exposing the federal enterprise to substantial risks.

Shut Down Phishing Attacks with Device Posture Security – Download Free E-Book

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles