CVE-2023-30738

An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Odyssey allows local attacker to execute SMM memory corruption.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:samsung:galaxy_book_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:samsung:galaxy_book:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:samsung:galaxy_book_pro_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:samsung:galaxy_book_pro:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:samsung:galaxy_book_pro_360_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:samsung:galaxy_book_pro_360:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:samsung:galaxy_book_odyssey_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:samsung:galaxy_book_odyssey:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-10-04 04:15

Updated : 2023-11-07 04:14

NVD link : CVE-2023-30738

Mitre link : CVE-2023-30738

CVE.ORG link : CVE-2023-30738

JSON object : View

Products Affected

samsung

galaxy_book_pro_firmware
galaxy_book_odyssey
galaxy_book_firmware
galaxy_book_pro_360_firmware
galaxy_book_odyssey_firmware
galaxy_book_pro
galaxy_book
galaxy_book_pro_360

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-30738", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "mobile.security@samsung.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2023-10-04T04:15:13.733", "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=10", "tags": ["Vendor Advisory"], "source": "mobile.security@samsung.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Odyssey allows local attacker to execute SMM memory corruption."}, {"lang": "es", "value": "Una validaci\u00f3n de entrada incorrecta en el firmware UEFI antes del lanzamiento de la actualizaci\u00f3n de firmware de octubre de 2023 en Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 y Galaxy Book Odyssey permite a un atacante local ejecutar corrupci\u00f3n de memoria SMM."}], "lastModified": "2023-11-07T04:14:04.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:samsung:galaxy_book_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D007B248-661D-4E53-A0C0-F3C49ED9540A", "versionEndExcluding": "oct-2023"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:samsung:galaxy_book:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4356A941-2FF9-4A68-8EF5-AB86576017DD"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:samsung:galaxy_book_pro_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D675EEE1-9A38-4667-9AE5-31FF8882603E", "versionEndExcluding": "oct-2023"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:samsung:galaxy_book_pro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C3A9C42E-F053-4C74-9248-33DAABF550F8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:samsung:galaxy_book_pro_360_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54974A58-DD3F-4088-BF2F-D150565B8FE3", "versionEndExcluding": "oct-2023"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:samsung:galaxy_book_pro_360:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4662A977-BFA4-41F0-95D9-BB0D8B077D66"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:samsung:galaxy_book_odyssey_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACBF7D53-8DAF-4853-92EE-298726BD0789", "versionEndExcluding": "oct-2023"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:samsung:galaxy_book_odyssey:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "402463AD-A75B-4127-BBE9-24AABEE40817"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "mobile.security@samsung.com"}