SAMSUNG Mobile Security Maintenance Release Summary January 2023
SAMSUNG 사이트 참고
SAMSUNG Mobile Security Maintenance Release Summary January 2023
Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.
Google patches include patches up to Android Security Bulletin – January 2023 package. The Bulletin (January 2023) contains the following CVE items:
Critical None High CVE-2021-39660, CVE-2022-23960(A-215557547), CVE-2022-32619, CVE-2022-32594, CVE-2022-32597, CVE-2022-32598, CVE-2022-32596, CVE-2022-25698, CVE-2022-25697, CVE-2022-25681, CVE-2022-25672, CVE-2022-25685, CVE-2022-25692, CVE-2022-25689, CVE-2022-25673, CVE-2022-25695, CVE-2022-25691, CVE-2022-25702, CVE-2022-25682, CVE-2022-33235, CVE-2022-39106, CVE-2022-39129, CVE-2022-39130, CVE-2022-39131, CVE-2022-39132, CVE-2022-39134, CVE-2022-42756, CVE-2022-42754, CVE-2022-42755, CVE-2022-39133, CVE-2022-42771, CVE-2022-42770, CVE-2022-42772, CVE-2022-20456, CVE-2022-20489, CVE-2022-20490, CVE-2022-20492, CVE-2022-20493, CVE-2023-20912, CVE-2023-20916, CVE-2023-20919, CVE-2023-20920, CVE-2023-20921, CVE-2022-20494, CVE-2023-20922, CVE-2022-20461, CVE-2023-20904, CVE-2023-20905, CVE-2023-20913, CVE-2023-20915 Moderate None Already included in previous updates CVE-2022-32620, CVE-2022-33238, CVE-2022-33268 Not applicable to Samsung devices None ※ Please see Android Security Bulletin for detailed information on Google patches. Along with Google patches, Samsung Mobile provides 20 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices. Samsung security index (SSI), found in “Security software version”, SMR Jan-2023 Release 1 includes all patches from Samsung and Google. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.
SVE-2022-2537(CVE-2023-21430): An out-of-bound read vulnerability in libSDKRecognitionText.spensdk.samsung.so library
Severity: Moderate Affected versions: Q(10), R(11), S(12), T(13) Reported on: October 24, 2022 Disclosure status: Privately disclosed An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Jan-2023 Release 1 allows attacker to cause memory access fault. The patch adds proper boundary check logic to prevent out-of-bound access.
SVE-2022-2338(CVE-2023-21429): Implicit intent hijacking vulnerability in ePDG
Severity: Moderate Affected versions: Q(10), R(11), S(12), T(13) Reported on: September 20, 2022 Disclosure status: Privately disclosed Improper usage of implicit intent in ePDG prior to SMR Jan-2023 Release 1 allows attacker to access SSID. The patch change the implicit intent to explicit intent.
SVE-2022-2320(CVE-2023-21428): Improper input validation vulnerability in TelephonyUI
Severity: Moderate Affected versions: R(11), S(12), T(13) Reported on: September 19, 2022 Disclosure status: Privately disclosed Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call. The patch removes unused code.
SVE-2022-2280(CVE-2023-21427): Improper access control vulnerabilities in NfcTile
Severity: Moderate Affected versions: R(11), S(12), T(13) Reported on: September 15, 2022 Disclosure status: Privately disclosed Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without user recognition. The patch adds proper permission in NfcTile to prevent unauthorized access.
SVE-2022-2278(CVE-2023-21426): Hardcoded encryption key vulnerability in NFC
Severity: Moderate Affected versions: Select Q(10) devices Reported on: September 15, 2022 Disclosure status: Privately disclosed Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN. The patch adds proper usage of random private key api to prevent key exposure.
SVE-2022-2261(CVE-2023-21425): Improper access control vulnerability in telecom application
Severity: Moderate Affected versions: Q(10), R(11), S(12), T(13) Reported on: September 15, 2022 Disclosure status: Privately disclosed Improper access control vulnerability in telecom application prior to SMR Jan-2023 Release 1 allows local attackers to get sensitive information. The patch adds proper access control logic to prevent sensitive information leakage.
SVE-2022-2118(CVE-2023-21424): Improper Authorization vulnerability in SemChameleonHelper
Severity: Moderate Affected versions: R(11), S(12), T(13) Reported on: September 3, 2022 Disclosure status: Privately disclosed Improper handling of insufficient permissions or privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify network related values, network code, carrier id and operator brand. The patch restricts privilege of the app that calls SemChameleonHelper in Telephony.
SVE-2022-1967(CVE-2023-21423): Improper authorization vulnerability in ChnFileShareKit
Severity: Moderate Affected versions: S(12), T(13) Reported on: August 17, 2022 Disclosure status: Privately disclosed Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unprotected action. The patch adds proper permission.
SVE-2022-1931(CVE-2023-21422): Improper authorization vulnerability in WifiSevice
Severity: Moderate Affected versions: R(11), S(12) Reported on: August 14, 2022 Disclosure status: Privately disclosed Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without permission via binding WifiService. The patch adds permission check logic when call the service API.
SVE-2022-1672(CVE-2023-21421): Improper Handling of Insufficient Permissions or Privileges vulnerability in Knox Service
Severity: Moderate Affected versions: Q(10), R(11), S(12), T(13) Reported on: July 14, 2022 Disclosure status: Privately disclosed Improper handling of insufficient permissions or privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access device SIM PIN. The patch adds proper signature check in KnoxCustomManagerService to prevent unauthorized access.
SVE-2022-1364(CVE-2023-21420): Use of Externally-Controlled Format String vulnerabilities in STST TA
Severity: High Affected versions: Q(10), R(11) devices with Teegris Reported on: June 3, 2022 Disclosure status: Privately disclosed Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary code execution. The patch restricts the triggering for the print of externally controlled format string code.
SVE-2022-0471(CVE-2023-21419): A vulnerability in Secure Folder
Severity: Moderate Affected versions: S(12) Reported on: February 28, 2022 Disclosure status: Privately disclosed An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under certain condition. The patch adds restriction that lock the SecureFolder container when PIP is closed. Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.
Acknowledgements
출처 : 바로가기
Last updated
