SecuriTricks - CVE-2024-46921

Description

An issue was discovered in Samsung Mobile Processor and Modem Exynos 9820, 9825, 980, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W1000, Modem 5123, Modem 5300, Modem 5400. UE does not limit the number of attempts for the RRC Setup procedure in the 5G SA, leading to a denial of service (battery-drain attack).

Product(s) Impacted

Product	Versions
Samsung Mobile Processor and Modem Exynos	['9820', '9825', '980', '990', '1080', '2100', '1280', '2200', '1330', '1380', '1480', '2400', '9110', 'W1000', 'Modem 5123', 'Modem 5300', 'Modem 5400']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

https://semiconductor.samsung.com/support/quality-support/product-security-updates/

https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-46921/

https://github.com/asset-group/5ghoul-5g-nr-attacks/tree/master

CVSS Score

6.5 / 10

CVSS Data - 3.1

Attack Vector: ADJACENT_NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View Vector String

Timeline

Published: Jan. 13, 2025, 7:15 p.m.
Last Modified: Jan. 31, 2025, 5:15 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@mitre.org

CVE-2024-46921