Samsung SLocation Improper Access Control Vulnerability Allowing Location Data Access

An improper access control vulnerability has been identified in the SLocation application, affecting several different versions of Android prior to the April 2023 Security Maintenance Release. This vulnerability allows local attackers to access device location information by using the com.samsung.android.wifi.GEOFENCE action. The issue arises from inadequate access control measures, which can be exploited to retrieve sensitive location data without proper authorization.

Impact

Exploitation of this vulnerability could lead to unauthorized access to device location information, potentially allowing attackers to track the user's movements or location history.

Remediation

Users can update their devices to the April 2023 Security Maintenance Release to address this vulnerability.