Description

An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580. Requesting oversized shared memory from the custos_iwc device enables out-of-bounds read and write, potentially leading to memory corruption or information leakage.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-14T02:17:14.390Z",
  "pubdate": "2026-09-14T02:17:14.390Z",
  "executiveSummary": "This vulnerability involves an out-of-bounds (OOB) read and write flaw within the CustOS driver of the Samsung Exynos 1580 mobile processor.\nThe issue stems from insufficient validation of shared memory requests submitted to the custos_iwc device.\nSuccessful exploitation allows an attacker to manipulate memory beyond the intended buffers, leading to memory corruption or the unauthorized disclosure of sensitive information (information leakage).\nThe impact is significant, as it resides within a low-level system driver, potentially allowing local users or compromised processes to achieve privilege escalation or persistent system instability.\nThe vulnerability requires local access to the device to interact with the vulnerable custos_iwc character device, making it a critical concern for mobile security and kernel integrity.\nThere are no specific authentication requirements mentioned, implying that any process with sufficient permissions to interact with the custos_iwc device interface may trigger the flaw.",
  "technicalDetails": "The vulnerability is rooted in an improper boundary check implementation during the handling of shared memory allocation requests within the custos_iwc driver component of the Samsung Exynos 1580 mobile processor.\nSpecifically, the driver fails to adequately sanitize or enforce bounds on the size parameters provided by a user-space application when requesting shared memory allocations via the device's interface.\nWhen a request for an 'oversized' shared memory allocation is processed, the driver fails to validate that the requested size is within the expected operational limits of the kernel-allocated buffer.\nThis oversight allows an attacker to pass an arbitrary, excessive size value, which leads the kernel to allocate or map memory incorrectly. Subsequent read or write operations directed at these oversized regions occur outside the intended memory bounds.\nIn an OOB write scenario, an attacker can corrupt adjacent kernel memory structures, such as function pointers, process credentials, or sensitive data objects, which can be leveraged to divert the control flow of the kernel or escalate privileges to root.\nIn an OOB read scenario, the attacker can extract data from memory pages that should be inaccessible to the process, leading to the leakage of cryptographic keys, kernel addresses (aiding in bypassing KASLR), or user data.\nThe attack flow typically involves the following steps: 1) The attacker gains access to the local system and identifies the custos_iwc device node, typically found under /dev/. 2) The attacker opens a file descriptor to the custos_iwc device. 3) The attacker issues an IOCTL or similar system call to the driver, supplying an oversized memory request parameter. 4) The driver, failing to perform input validation on the size, processes the request and maps an oversized segment. 5) The attacker performs read or write operations on the buffer, targeting adjacent memory regions outside the intended allocation. 6) The attacker achieves the desired impact, such as crashing the system (DoS), leaking secrets, or executing arbitrary code with kernel-level privileges."
}