Google’s Threat Analysis Group found a major security flaw in some Exynos chips in Samsung Galaxy smartphones, according to posts from both Google and Samsung this month.
As PCMag reports, the bug affects processors using Exynos versions 9820, 9825, 980, 990, 850, and W920. It allows malicious actors to escalate privileges and execute arbitrary code remotely, according to Google’s security researchers Xingyu Jin and Clement Lecigene.
The exposed Exynos chips power Samsung smartphones like the Galaxy S10 series, Galaxy Note 10 and 10+, Galaxy S20 series, Galaxy A51 5G, Galaxy A71, and some Galaxy Watches. A quick search on Samsung’s website shows that the Galaxy M13, M62, A13, A21s, A04s, F12, M12, XCover 5, and F62 were also impacted.
In its advisory, Samsung labeled the flaw as a “use-after-free” memory bug and gave it a high severity rating. The company also acknowledged Google’s Xingyu Jin for reporting the bug back in July.
The Google group’s research mentions that the Exynos security flaw has been exploited in the wild, likely in concert with other exploits, but didn’t identify any malicious actors. The group usually tracks the activities of nation-states and state-sponsored threat actors. “Samsung is committed to providing the highest level of security for our users. We are aware of the potential security vulnerability mentioned,” a Samsung spokesperson told The Register via email.
To address the issue, Samsung has started rolling out security patches as part of its monthly security maintenance releases. Users can fix the issue by installing a security update Samsung released on Oct. 7. “We strongly recommend that users keep their devices up-to-date with the latest software updates,” Samsung said in a statement.
—
Photo Credit: Karlis Dambrans / Shutterstock.com