Description

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Sending a malformed message to the test_msg sysfs entry causes an out-of-bounds write, leading to denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.8",
  "pubDate": "2026-09-14T02:17:14.230Z",
  "pubdate": "2026-09-14T02:17:14.230Z",
  "executiveSummary": "This vulnerability is an out-of-bounds write flaw located within the camera subsystem driver of various Samsung Mobile Processor Exynos chipsets. The issue manifests when the system handles input provided to the test_msg sysfs entry. An attacker capable of interacting with this kernel-level interface can supply a malformed message, triggering a memory corruption event that writes data outside the intended memory boundaries. The primary security impact is a Denial of Service (DoS), resulting in system instability or a kernel panic. The vulnerability affects Exynos 1330, 1380, 1480, 2400, 1580, and 2500 chipsets. Successful exploitation requires local access to the device and the ability to interact with the exposed sysfs interface. Given the nature of out-of-bounds memory operations, this flaw presents a significant risk to device availability and potential for further exploitation if the memory corruption can be weaponized for arbitrary code execution.",
  "technicalDetails": "The vulnerability resides in the camera driver component responsible for handling debug and diagnostic messages via the sysfs virtual file system. Specifically, the test_msg entry acts as a communication interface between user-space and the kernel-mode driver, intended for verification or debugging routines. The root cause of the vulnerability is the lack of proper input validation and bounds checking on the data buffer passed from user-space into the kernel during a write operation to test_msg.\nWhen a malformed message is transmitted to this entry, the driver fails to verify that the length of the input data corresponds to the allocated size of the kernel-side buffer. Consequently, the driver performs an out-of-bounds write, overwriting adjacent memory locations in kernel space. This corruption of the kernel heap or static memory areas disrupts critical data structures or control flow mechanisms within the camera driver or the kernel memory management unit.\nThe attack flow begins with the adversary gaining access to the local shell environment or an application with sufficient permissions to write to /sys/class/camera/.../test_msg. Upon opening the file descriptor, the attacker injects a maliciously crafted payload designed to exceed the internal buffer constraints. The driver, processing this input without sanitization, executes a copy or write operation that overflows the allocated buffer. The immediate consequence is a crash of the affected driver module or a complete system failure, manifesting as a Denial of Service. Because the operation occurs at the kernel level, the attacker typically requires elevated local privileges or access to device nodes that are often restricted by SELinux or other hardware-based security policies. However, if the sysfs entry is globally readable/writable, the attack surface is significantly expanded. While the primary impact described is a crash (DoS), the nature of out-of-bounds writes in kernel memory often leads to security researchers investigating the potential for privilege escalation by overwriting function pointers or kernel objects (e.g., credentials or process descriptors) located adjacent to the overflowed buffer."
}