Google Project Zero team found severe 0-day vulnerabilities with the Samsung Exynos modem. Affected Exynos modem used in various Samsung devices including the Galaxy S22 series.
According to the information, Project Zero reported 18 vulnerabilities in Exynos modems in late 2022 and early 2023. And notably, four of the flaws, including CVE-2023-24033, involve internet-to-baseband remote code execution.
Samsung Semiconductor (January 2023) data reveals that Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T5123 are affected chipsets.
Samsung Galaxy:
• S22 series
• M33
• M13
• M12
• A71
• A53
• A33
• A21
• A13
• A12
• A04 series
• Watch 4 series
• Watch 5 series
Wearable:
• Any wearables that use the Exynos W920 chipset
Vehicle:
• Any vehicles that use the Exynos Auto T5123 chipset
• S22 series
• M33
• M13
• M12
• A71
• A53
• A33
• A21
• A13
• A12
• A04 series
• Watch 4 series
• Watch 5 series
Wearable:
• Any wearables that use the Exynos W920 chipset
Vehicle:
• Any vehicles that use the Exynos Auto T5123 chipset
Samsung said:
At the end of last year, we received a security issue notification for Google project zero, and Samsung has provided all customers with a patch version for this vulnerability, and the related issues have now been resolved.
Precaution:
Until security updates are available, users who wish to protect themselves from the baseband remote code execution vulnerabilities in Samsung’s Exynos chipsets can turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings. Turning off these settings will remove the exploitation risk of these vulnerabilities.
