Description

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver (due to missing input length validation in color mode LUT parsing) leads to kernel memory corruption and potential privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-14T02:17:13.673Z",
  "pubdate": "2026-09-14T02:17:13.673Z",
  "executiveSummary": "This vulnerability is an out-of-bounds write flaw identified within the Display Processing Unit (DPU) driver of multiple Samsung Mobile Processor Exynos chipsets.\nThe issue stems from insufficient input length validation during the parsing of color mode Lookup Table (LUT) data.\nSuccessful exploitation allows an attacker to achieve kernel memory corruption, which can lead to privilege escalation and compromise the integrity of the device's kernel space.\nThe vulnerability affects Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 processors.\nThis represents a critical security risk, as it permits unauthorized execution of arbitrary code with kernel-level privileges.\nExploitation typically requires an attacker to interact with the DPU driver interface, necessitating local access or the ability to communicate with the driver via malicious user-space applications.",
  "technicalDetails": "The vulnerability is situated within the Exynos DPU driver, specifically residing in the component responsible for processing and applying color mode Lookup Tables (LUTs).\nThe root cause is a failure in the driver to enforce strict boundary checks on the length of input data provided to the LUT parsing functions. Because the driver trusts the user-supplied length fields without validating them against the actual buffer size allocated for LUT operations, a malicious actor can supply crafted inputs that exceed the bounds of the destination buffer.\nThe attack flow initiates when a privileged user-space process or a malicious application invokes the DPU driver's IOCTL or relevant interface to configure display properties, specifically focusing on the color mode LUT settings. By submitting a payload with a forged length parameter that surpasses the buffer capacity, the attacker triggers an out-of-bounds write operation.\nWhen the driver attempts to copy the user-provided data into the kernel-space memory buffer, the lack of input validation allows the data to overflow, overwriting adjacent memory segments in the kernel heap or data section. This memory corruption can be leveraged to modify kernel structures, such as function pointers or sensitive kernel objects, effectively enabling the redirection of control flow.\nBy systematically overwriting specific kernel pointers, an attacker can gain arbitrary code execution, facilitating the escalation of privileges from a standard application context to that of the kernel. This post-exploitation impact allows for the circumvention of Android security models, enabling persistence, data exfiltration, or the disabling of security features.\nAffected platforms include the Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. The vulnerability resides at the kernel driver level, making it independent of specific display resolutions but dependent on the driver's handling of the DPU hardware interface. No authentication is inherently required if the user-space process has permission to communicate with the DPU device node, which is common for many applications needing display or hardware acceleration access."
}