Introduction
Unexpected loss of cellular connectivity on flagship smartphones and wearables can disrupt critical communications, especially for enterprise users and first responders. A recently disclosed vulnerability in Samsung's Exynos baseband firmware creates a denial-of-service risk on a wide range of modern devices, including those built on the latest Exynos 2400 and W1000 chipsets.
About Samsung Exynos: Samsung Electronics is a major global semiconductor manufacturer. Its Exynos chips power Samsung Galaxy smartphones and wearables as well as devices from other manufacturers, so the security of this firmware matters to millions of users across the mobile ecosystem.
Technical information
CVE-2024-55568 comes from a missing NULL pointer check in the UL2 component of Samsung Exynos baseband firmware. The bug triggers while the firmware processes Mobility Management (MM) protocol packets. When a malformed MM packet arrives, the firmware dereferences a pointer without first checking whether it is NULL. The baseband processor then crashes or hangs, which causes a denial of service (DoS). The device may lose all cellular connectivity or need a reboot before it works normally again.
The flaw is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-476 (NULL Pointer Dereference). To exploit it, an attacker sends specially crafted MM packets to the device, which they can do by operating a rogue base station or by compromising network infrastructure. No public code snippets or proof of concept are available for this vulnerability.
Affected systems and versions
The following Samsung Exynos products are affected:
- Exynos 980
- Exynos 990
- Exynos 850
- Exynos 1080
- Exynos 2100
- Exynos 1280
- Exynos 2200
- Exynos 1330
- Exynos 1380
- Exynos 1480
- Exynos 2400
- Exynos 9110
- Exynos W920
- Exynos W930
- Exynos W1000
- Exynos Modem 5123
- Exynos Modem 5300
- Exynos Modem 5400
Every firmware version for these products released before Samsung's official patch is affected. Public advisories do not give specific version ranges.
Vendor security history
Samsung has a documented history of baseband and Exynos vulnerabilities. In March 2023, Google Project Zero disclosed critical remote code execution flaws in Exynos modems (CVE-2023-24033 and others), which advanced threat actors actively targeted. Samsung runs a monthly security update program and works with external researchers on vulnerability disclosure. How quickly patches arrive varies by product and region, and some older devices may not get updates in time.
