Millions of Samsung users may be at risk if they don’t download the latest update for their devices, according to a recent warning from Google’s Threat Analysis Group.
The team identified a vulnerability—named CVE-2024-44068—in certain Galaxy models, which could expose users and their data to potential threats.
Though this bug hasn’t been classified as “critical,” it is still important to address. If exploited, the flaw could allow hackers to gain control over affected phones, enabling them to perform remote actions without the owner’s consent.
This vulnerability impacts various devices that use Samsung’s Exynos processors, specifically the Exynos 9820, 9825, 980, 990, 850, and W920.
Some of these chips power widely used models like the Galaxy S10, which has been sold to millions of users globally.
The National Institute of Standards and Technology (NIST) issued an advisory stating, “An issue was discovered in the m2m scaler driver in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850, and W920. A use-after-free in the mobile processor leads to privilege escalation.”
It’s now essential for users to check their device settings and download the latest updates from Samsung, as these updates include fixes for this vulnerability and others that could arise.
To update your device:
- Swipe down from the top of the screen and tap the Settings icon.
- Go to Software update or System updates (this may vary depending on the model).
- Tap Download and install, Check for system updates, or Check for software updates.
- If an update is available, it should begin downloading automatically. On some devices, you may need to tap Download now to initiate it.
Boris Cipot, senior security engineer at Black Duck, commented on the situation: “Although this vulnerability may not be classified as highly critical, it still poses potential risks that users of affected devices need to be aware of.
By exploiting CVE-2024-44068, an attacker can gain higher access, allowing them to take control of the device and bypass its security measures.
“Once inside, the attacker could run malicious code, steal data, or even spy on the user, depending on their strategy and motivations.
To protect against this, users should first ensure they have the latest security patches installed. The most recent update, released in October, addresses this vulnerability.”
