Samsung ONE Integer Overflow Vulnerability Allowing Out-of-Range Operator-Code Lookup

An integer overflow vulnerability has been identified in Samsung ONE, prior to version 1.30.0, allowing for out-of-range operator-code lookups during model loading. This issue arises from missing bounds validation for operators, which could lead to improper memory size calculations for tensors.

Impact

Exploitation of this vulnerability could result in memory corruption or other unintended behavior due to the out-of-range operator-code lookup.

Remediation

Users can update to Samsung ONE version 1.30.0 or later to address this vulnerability.