New update warning for millions of Samsung Galaxy users
AFP via Getty Images
Samsung’s Galaxy updates—or lack thereof—have been making headlines throughout October. with disappointing delay of One UI 7 and Android 15 confirmed at SDC. There was also warning from Google that attacks exploited vulnerabilities in Samsung’s own chipsetsurging users to install the October security update.
But while Samsung was quick to update information about the risks associated with its own Exynos processors in October, the critical question for Galaxy users will be whether the November monthly security release will fix yet another vulnerability that is now under attack.
This alert affects several Qualcomm chipsets, with the manufacturer saying that “Google’s threat intelligence team has indications that CVE-2024-43047 may be subject to limited targeted exploitation.” The company said it provided fixes to device OEMs in September and encouraged them to deploy those fixes “to released devices as soon as possible.” Amnesty International has also weighed in on the matter, suggesting targeted attacks on reporters, dissidents and activists.
This active exploitation prompted the US cybersecurity agency to add CVE-2024-43047 to its catalog of known exploitable vulnerabilities, requiring all federal employees to update their devices. CISA warned that “several Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP services when storing HLOS memory cards.” This type of memory threat occurs when a device’s heap memory pointer is not cleaned up properly, leaving it open to manipulation by malicious code to access that memory.
This vulnerability was not fixed in either the October releases or Android or Samsungbut will most likely be released in the November Android update. Interestingly, this means that all users will miss the October 29 CISA update deadline.
The risk for Samsung users is that Qualcomm’s latest updates became available to Galaxy users only a month after they appeared in Android security. bulletin that will leave Galaxy devices vulnerable until December. Samsung warns that “some fixes that will be received from chipset manufacturers may not be included in the month’s security update package. These will be included in upcoming security update packages as soon as the patches are ready for release.” I asked Samsung for confirmation that this particular update would be included in November.
When this update is released, you should check for CVE-2024-43047 in the patch list and ensure that your device is included in the monthly update schedule. Otherwise, and if you have reason to be concerned about spyware or other threats to your phone, you should pay particular attention to Google’s and Amnesty’s warnings.
Affected chipsets
Qualcomm
The list of affected chipsets above is extensive, but special attention will be paid to the different generations of Snapdragon, including Snapdragon 8 (Gen 1), as they will impact several Samsung devices. You can check if yours is on this list here..