CVE-2024-31960

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

A

n issue was discovered in Samsung Mobile Processor Exynos 1480, Exynos 2400. The xclipse amdgpu driver has a reference count bug. This can lead to a use after free.

References

Link	Resource
https://semiconductor.samsung.com/support/quality-support/product-security-updates/	Vendor Advisory
https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-31960/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:samsung:exynos_1480_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:samsung:exynos_1480:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:samsung:exynos_2400_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:samsung:exynos_2400:-:*:*:*:*:*:*:*

History

24 Sep 2024, 18:08

Type	Values Removed	Values Added
Summary		(es) Se ha descubierto un problema en el procesador móvil Samsung Exynos 1480 y Exynos 2400. El controlador xclipse amdgpu tiene un error de recuento de referencias. Esto puede provocar un use after free.
First Time		Samsung exynos 2400 Samsung exynos 1480 Samsung exynos 2400 Firmware Samsung Samsung exynos 1480 Firmware
CPE		cpe:2.3:h:samsung:exynos_1480:-:::::::* cpe:2.3:o:samsung:exynos_1480_firmware:-:::::::* cpe:2.3:o:samsung:exynos_2400_firmware:-:::::::* cpe:2.3:h:samsung:exynos_2400:-:::::::*
References	~~() https://semiconductor.samsung.com/support/quality-support/product-security-updates/ -~~	() https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - Vendor Advisory
References	~~() https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-31960/ -~~	() https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-31960/ - Vendor Advisory

10 Sep 2024, 20:35

Type	Values Removed	Values Added
CWE		CWE-416

10 Sep 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-10 16:15

Updated : 2024-09-24 18:08

NVD link : CVE-2024-31960

Mitre link : CVE-2024-31960

CVE.ORG link : CVE-2024-31960

JSON object : View

Products Affected

CWE

CWE-416

Use After Free

{"id": "CVE-2024-31960", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-09-10T16:15:19.580", "references": [{"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-31960/", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-416"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Samsung Mobile Processor Exynos 1480, Exynos 2400. The xclipse amdgpu driver has a reference count bug. This can lead to a use after free."}, {"lang": "es", "value": "Se ha descubierto un problema en el procesador m\u00f3vil Samsung Exynos 1480 y Exynos 2400. El controlador xclipse amdgpu tiene un error de recuento de referencias. Esto puede provocar un use after free."}], "lastModified": "2024-09-24T18:08:34.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:samsung:exynos_1480_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64897B0D-EBF6-4BEB-BF54-ABCDBFAB45E0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:samsung:exynos_1480:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F3F328B4-0442-4748-B5EE-DD1CEE50D6CF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:samsung:exynos_2400_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16D9272E-1794-48FF-B6A4-8F48395BA38E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:samsung:exynos_2400:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "932F5FB3-5527-44D7-9DD9-EF03963E3CA3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}