Samsung Exynos Fastboot USB Interface Improper Input Validation Vulnerability Allowing Arbitrary Code Execution in Bootloader

A vulnerability exists in the Exynos Fastboot USB interface on select devices running Android 11, 12, or 13, prior to the April 2023 Security Maintenance Release. This vulnerability allows a physical attacker to execute arbitrary code in the bootloader due to improper input validation. The issue was privately disclosed and is part of a broader set of vulnerabilities addressed in the April 2023 SMR.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the bootloader, which could potentially be used to compromise the device at a low level, such as unlocking the bootloader or flashing a custom recovery.

Remediation

Users can update their devices to the April 2023 Security Maintenance Release to address this vulnerability.