CVE-2023-26076

CVSS V2 None CVSS V3 None

Description

An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. An intra-object overflow in the 5G SM message codec can occur due to insufficient parameter validation when decoding reserved options.

Overview

CVE ID
CVE-2023-26076

Assigner
cve@mitre.org

Vulnerability Status
Modified

Published Version
2023-03-13T15:15:12

Last Modified Date
2023-03-20T15:15:11

Weakness Enumerations

CWE	URL
CWE-120	http://cwe.mitre.org/data/definitions/120.html

CPE Configuration (Product)

CPE	Vulnerable	Operator
		AND
cpe:2.3:o:samsung:exynos_1280_firmware:-:::::::*	1	OR
cpe:2.3:h:samsung:exynos_1280:-:::::::*	0	OR
		AND
cpe:2.3:o:samsung:exynos_2200_firmware:-:::::::*	1	OR
cpe:2.3:h:samsung:exynos_2200:-:::::::*	0	OR
		AND
cpe:2.3:o:samsung:exynos_modem_5123_firmware:-:::::::*	1	OR
cpe:2.3:h:samsung:exynos_modem_5123:-:::::::*	0	OR
		AND
cpe:2.3:o:samsung:exynos_modem_5300_firmware:-:::::::*	1	OR
cpe:2.3:h:samsung:exynos_modem_5300:-:::::::*	0	OR
		AND
cpe:2.3:o:samsung:exynos_auto_t5123_firmware:-:::::::*	1	OR
cpe:2.3:h:samsung:exynos_auto_t5123:-:::::::*	0	OR

References

Reference URL	Reference Tags
http://packetstormsecurity.com/files/171400/Shannon-Baseband-NrSmPcoCodec-Intra-Object-Overflow.html
https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html
https://semiconductor.samsung.com/processor/mobile-processor/	Product
https://semiconductor.samsung.com/processor/modem/	Product
https://semiconductor.samsung.com/support/quality-support/product-security-updates/	Vendor Advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-26076
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26076

History

Created	Old Value	New Value	Data Type	Notes
2023-04-17 06:20:27				Added to TrackCVE
2023-04-17 06:20:29			Weakness Enumeration	new