CVE-2022-22265: medium-severity vulnerability in Samsung Mobile Devices
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
The NPU driver fails to properly validate exceptional conditions, allowing an attacker to write arbitrary data to memory and execute malicious code on the system.
A missing or insufficient exception handling mechanism in the NPU driver prior to SMR Jan-2022 Release 1 permits arbitrary memory write operations that can be leveraged to achieve code execution. The vulnerability requires local access to interact with the driver but does not require elevated privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.