Google Researchers Reveal Critical Exploit in Samsung Phones. Here is what to know.

Researchers at Google Project Zero recently disclosed a now-patched zero-click vulnerability. This vulnerability could allow remote attackers to execute arbitrary code on Samsung devices without any user interaction.

The Flaw and Affected Devices

The flaw, tracked as CVE-2024-49415, is an out-of-bounds write issue in the saped_rec function of the libsaped.so library. This library is part of the C2 media service responsible for audio playback. The vulnerability affected the Monkey’s Audio (APE) decoder used in Samsung’s flagship Galaxy S23 and S24 devices running Android versions 12, 13, and 14.

Discovery and Reporting

Natalie Silvanovich, a Google Project Zero researcher, identified and reported the vulnerability to Samsung on September 21, 2024. She explained that the attack could be carried out by sending a malicious audio file that does not require any user involvement, making it potentially dangerous.

How the Exploit Works

The flaw occurred due to Samsung’s handling of RCS (rich communication services) messages. Specifically, it involved how incoming audio messages are parsed and processed through the Google Messages app in Android. This setting is enabled by default on the Galaxy S23 and S24 models.

Hypothetical Attack Scenario

In a hypothetical attack scenario, an attacker can exploit the vulnerability by sending a specially crafted audio message on RCS-enabled devices. This would cause the device’s media codec process (samsung.software.media.c2) to crash and open a way for further exploitation.

Additional Vulnerabilities Fixed

Additionally, Samsung’s December 2024 update also fixed another vulnerability: CVE-2024-49413, which involved the SmartSwitch app. This flaw allowed local attackers to install malicious applications by exploiting insufficient cryptographic signature verification.

Recommendations and Precautions

While Samsung has fixed the flaws, it is recommended that users update their RCS-enabled devices with the latest security updates. Additionally, it is advisable to disable RCS in Google Messages to reduce the risk of zero-click exploits further.

Conclusion

This discovery highlights the importance of staying vigilant and keeping devices updated with the latest security patches. It also underscores the ongoing challenge of securing modern communication technologies against sophisticated attacks.

You think you have a story worth everyone’s time? SUBMIT A STORY and we will publish it