CVE-2017-18020
Last modified
CVE-2017-18020 is a vulnerability of currently unknown severity. On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) software and Exynos chipsets, attackers can execute arbitrary code in the bootloader because S Boot omits a size check during a copy of ramfs data to memory. The Samsung ID is SVE-2017-10598.. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) software and Exynos chipsets, attackers can execute arbitrary code in the bootloader because S Boot omits a size check during a copy of ramfs data to memory. The Samsung ID is SVE-2017-10598.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Samsung | Samsung Mobile | 5.0 |
| Samsung | Samsung Mobile | 5.1 |
| Samsung | Samsung Mobile | 5.1.1 |
| Samsung | Samsung Mobile | 6.0 |
| Samsung | Samsung Mobile | 6.0.1 |
| Samsung | Samsung Mobile | 7.0 |
| Samsung | Samsung Mobile | 7.1 |
| Samsung | Samsung Mobile | 7.1.1 |
| Samsung | Samsung Mobile | 7.1.2 |
References
- https://security.samsungmobile.com/securityUpdate.smsbVendor Advisory
- https://security.samsungmobile.com/securityUpdate.smsbVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-18020?
How severe is CVE-2017-18020?
How do I fix CVE-2017-18020?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-18014An NC-25986 issue was discovered in the Logging subsystem of…
- CVE-2017-18015The ILLID Share This Image plugin before 1.04 for WordPress …
- CVE-2017-18016Parity Browser 1.6.10 and earlier allows remote attackers to…
- CVE-2017-18017The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS…9.8
- CVE-2017-18018In GNU Coreutils through 8.29, chown-core.c in chown and chg…7.1
- CVE-2017-18019In K7 Total Security before 15.1.0.305, user-controlled inpu…
- CVE-2017-18021It was discovered that QtPass before 1.2.1, when using the b…
- CVE-2017-18022In ImageMagick 7.0.7-12 Q16, there are memory leaks in Monta…
- CVE-2017-18023Office Tracker 11.2.5 has XSS via the logincount parameter t…
- CVE-2017-18024AvantFAX 3.3.3 has XSS via an arbitrary parameter name to th…
- CVE-2017-18025cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allow…9.8
- CVE-2017-18026Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3…
Are you affected by CVE-2017-18020?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST