Mali security flaws affect millions of Samsung phones with Exynos

Phone

Millions of Samsung phones powered by Exynos, or more specifically, Exynos chipsets with Mali GPUs (of which there are many), are currently vulnerable to several security exploits. One can lead to kernel memory corruption, another to physical memory addresses being disclosed, and three other vulnerabilities can lead to a physical page us-after-free condition.

In essence, these vulnerabilities could allow an attacker to continue to read and write physical pages after they had been returned to the system. Or in other words, an attacker with native code execution in an app could gain full access to the system and bypass the permission model in Android OS. (via Google Project Zero)

ARM fixed the issue, but smartphone manufacturers have not

These security flaws discovered by Project Zero were brought to ARM's attention in June and July. ARM fixed these Mali-related security flaws a month later, but as of this writing, no smartphone vendors have applied security patches to address these vulnerabilities.

The Mali GPU from ARM can be found in smartphones across different brands, including Samsung, Xiaomi, and Oppo. In fact, the exploit was originally discovered as it was targeting the Pixel 6. Google hasn't patched this vulnerability either, despite Project Zero's efforts to bring the problem to light.

This vulnerability doesn't concern Samsung devices powered by Snapdragon or the Galaxy S22 series. Yes, the latter has an Exynos chipset in some markets, but it uses an Xclipse 920 graphics chip rather than a Mali GPU.

Mihai Matei - Senior Editor

[email protected]

First Samsung device: SGH-A800

Mihai is a blogger and column writer at SamMobile. His first Samsung phone was an A800 which took a lot of beating, and a part of him still misses the novelty of the clamshell design. In his free time, he enjoys watching shows, documentaries, and stand-up comedy; listening to music, taking walks, and occasionally playing old(er) video games.

Phone Tablet Exynos

Mali security flaws affect millions of Samsung phones with Exynos

ARM fixed the issue, but smartphone manufacturers have not

Mihai Matei - Senior Editor

[email protected]

First Samsung device: SGH-A800

You might also like

Google's next Tensor chip has a Samsung connection despite TSMC switch

Samsung's new mid-range Exynos chip for Galaxy A57 appears

Exynos 2500 chip's performance revealed ahead of debut

Galaxy Watch 8 won't get a performance upgrade