CISA has issued a recent warning regarding a security flaw that impacts Samsung devices, enabling attackers to circumvent Android’s address space layout randomization (ASLR) protection during targeted attacks.
ASLR serves as a crucial security feature in Android, ensuring that the memory addresses where essential app and operating system components are loaded into the device’s memory undergo randomization.
Introducing this mechanism significantly enhances the complexity for potential attackers attempting to exploit memory-related vulnerabilities, thereby heightening the challenge of executing successful attacks such as buffer overflow, return-oriented programming, or other exploits that rely on manipulating memory.
Samsung mobile devices that are operating on the following versions of Android OS are susceptible to the vulnerability (CVE-2023-21492), which arises from the inadvertent inclusion of sensitive data in log files:-
Local attackers possessing elevated privileges can leverage the disclosed information to carry out an ASLR bypass, consequently facilitating the exploitation of the vulnerabilities in memory management.
As part of the latest security updates, Samsung has effectively resolved this matter by implementing measures that prevent kernel pointers from being logged in future occurrences.
According to the May 2023 Security Maintenance Release (SMR) advisory, Samsung has acknowledged being informed about an exploit targeting this particular issue in the wild.
Although Samsung did not disclose specific information regarding the exploitation of CVE-2023-21492, it is important to note that during highly targeted cyberattacks, security vulnerabilities are frequently exploited within the complicated chain of exploits.
These campaigns employed chains of exploits targeting the following platforms’ vulnerabilities to deploy commercially-driven spyware:-
While apart from this, there are two separate attack campaigns were identified and disclosed by the security analysts at Google’s Threat Analysis Group (TAG) and Amnesty International in March.
Following CISA’s recent inclusion of the CVE-2023-21492 vulnerability in its list of Known Exploited Vulnerabilities, U.S. Federal Civilian Executive Branch Agencies (FCEB) have been granted a three-week timeframe until June 9 to fortify their Samsung Android devices against potential attacks exploiting this security flaw.
In accordance with BOD 22-01, federal agencies must patch all flaws added to CISA’s KEV list by the deadline of June 9, 2023.
The cybersecurity agency’s list of bugs exploited in attacks is valuable for U.S. federal agencies and private companies.
Private organizations can significantly reduce their risk of being successfully attacked by prioritizing the remediation of vulnerabilities on this list, along with federal agencies.
Frequent vulnerabilities serve as prime targets for cyber attackers, exposing the federal enterprise to substantial risks.
Shut Down Phishing Attacks with Device Posture Security – Download Free E-Book
In a groundbreaking discovery on November 20, 2024, cybersecurity researchers Shubham Shah and a colleague…
A security flaw found in Android-based kiosk tablets at luxury hotels has exposed a grave…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued six Industrial Control Systems (ICS) advisories…
A sophisticated cyber campaign dubbed "J-magic" has been discovered targeting enterprise-grade Juniper routers with a…
In January, Netskope Threat Labs uncovered a sophisticated global malware campaign leveraging fake CAPTCHA pages…
In a recent technical investigation, researchers uncovered critical insights into the infrastructure linked to a…