Security flaw found in Samsung’s system-on-chip
A member of an XDA developers forum who calls him-or-herself alephzain claims to have found a flaw in several Samsung handsets and tablets that could allow attackers to enjoy access to their RAM.
Alephzain posted news of the flaw here, stating that “The security hole is in kernel, exactly with the device /dev/exynos-mem.”
Exynos is Samsung’s ARM-based system on a chip and is found in a great many of its devices.
Alephzain’s asessment of the flaw follows:
“The good news is we can easily obtain root on these devices and the bad is there is no control over it.
Ram dump, kernel code injection and others could be possible via app installation from Play Store. It certainly exists many ways to do that but Samsung give an easy way to exploit. This security hole is dangerous and expose phone to malicious apps.
Exploitation with native C and JNI could be easily feasible.”
The flaw has attracted attention from others in the same forums, one of which – Chainfire – has thoughtfully provided an exploit for the flaw and warned “any app can use it to gain root without asking and without any permissions on a vulnerable device” before adding “Let’s hope for some fixes ASAP.”
Devices in trouble are said to include the Galaxy SIII, Galaxy Note, Galaxy Note 2 and Galaxy 10.1 tablets.
Members of the XDA developers community are evidently quite keen on the flaw, as it will allow them to do some low level hacking on their preferred Samsung devices. Community members say they’ve told Samsung about the problem, which should allow the rest of us to Keep Calm and Not Download Apps until a fix is issued. ®
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/12/17/samsung_exynos_flaw/