Flip off VoLTE, Wi-Fi calling as a consequence of Exynos vulnerability

2023-03-16 19:09:51

Google’s Mission Zero group discovered extreme 0-day vulnerabilities with the Samsung Exynos modems used on the Pixel 6 and seven, Samsung telephones and wearables, and different units that warrant disabling VoLTE and Wi-Fi calling till patched.

Exynos modem vulnerabilities

Recognized for locating 0-days, Mission Zero reported 18 vulnerabilities in Exynos modems in late 2022 and early 2023. 4 of the vulnerabilities, together with CVE-2023-24033, contain internet-to-baseband distant code execution (emphasis ours):

Assessments carried out by Mission Zero verify that these 4 vulnerabilities permit an attacker to remotely compromise a telephone on the baseband stage with no person interplay, and require solely that the attacker know the sufferer’s telephone quantity. With restricted extra analysis and improvement, we consider that expert attackers would have the ability to rapidly create an operational exploit to compromise affected units silently and remotely.

In the meantime, the opposite 14 vulnerabilities are thought of not as extreme as they “require both a malicious cellular community operator or an attacker with native entry to the machine.”

Mission Zero is making a “coverage exception to delay disclosure for the 4 vulnerabilities that permit for internet-to-baseband distant code execution.” That is “as a consequence of a really uncommon mixture of stage of entry these vulnerabilities present and the pace with which we consider a dependable operational exploit might be crafted.”

Affected units

In accordance with Samsung Semiconductor (January 2023), these are the affected chipsets: Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T5123. Google compiled an inventory of probably affected merchandise:

Samsung Galaxy telephones together with these within the S22, M33, M13, M12, A71, A53, A33, A21, A13, A12, and A04 collection
Vivo telephones together with these within the S16, S15, S6, X70, X60, and X30 collection
Google Pixel 6 and 6 Professional, Pixel 6a, Pixel 7 and seven Professional
Any wearables that use the Exynos W920 chipset
Any automobiles that use the Exynos Auto T5123 chipset

Apart from the Pixel 6 (Exynos 5123) and 7 (Exynos 5300), this consists of the S22, in addition to the Galaxy Watch 4 and 5. On Pixel telephones, the primary CVE-2023-24033 vulnerability was fastened with the March 2023 security patch that rolled out on Monday however ought to have come a week earlier.

Flip off VoLTE and Wi-Fi calling

Nonetheless, the Pixel 6, 6 Professional, and 6a have but to see that March replace and are at the moment weak. Mission Zero’s recommendation for these impacted follows:

Till safety updates can be found, customers who want to defend themselves from the baseband distant code execution vulnerabilities in Samsung’s Exynos chipsets can flip off Wi-Fi calling and Voice-over-LTE (VoLTE) of their machine settings. Turning off these settings will take away the exploitation threat of those vulnerabilities.

In accordance with an older Dash/T-Cell support article, “Google Pixel units acquired software program updates in 2021 that mechanically enabled VoLTE and eliminated the toggle.” You possibly can disable Wi-Fi calling on Pixel telephones in Settings app > Community & web > SIMs > Wi-Fi calling.

Updating…