New update alert for millions of Samsung Galaxy users
AFP via Getty Images
Samsung’s Galaxy updates – or lack thereof – have been in the news all October. with the frustrating delay on One UI 7 and Android 15 confirmed on SDC. There was too a warning from Google that attacks had exploited vulnerabilities in Samsung’s own chipsetsurging users to apply the October security update.
But while Samsung was quick to update the risks with its own Exynos processors in October, the crucial question for Galaxy users will be whether the November monthly security release, due out soon, will patch a new vulnerability that is now is being attacked.
This alert affects multiple Qualcomm chipsets, with the manufacturer advising that “there is evidence from the Google Threat Analysis Group that CVE-2024-43047 may be under limited targeted exploitation.” It says it made fixes available to device OEMs in September and urged them to deploy these patches “to released devices as soon as possible.” Amnesty has also spoken out about this, suggesting targeted attacks on reporters, dissidents and activists.
This active exploitation prompted the US Cybersecurity Agency to add CVE-2024-43047 to the Known Exploited Vulnerability catalog, requiring all federal employees to update their devices. CISA warned that “multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP services while preserving HLOS memory maps.” This type of memory threat occurs when a reference to dynamic device memory is not properly cleared, leaving it open to manipulation by malicious code to access that memory.
This vulnerability was not patched in the October releases of either Android or Samsungbut will likely be released in the November Android update. Interestingly, this means that all users will miss the October 29 CISA update deadline.
The risk for Samsung users is that recent Qualcomm updates have only been made available to Galaxy users a month after they appeared in Android security bulletin, which would leave Galaxy devices vulnerable until December. Samsung warns that “some patches received from chipset vendors may not be included in the month’s security update package. They will be included in upcoming security update packages as soon as the patches are ready for delivery.” I’ve asked Samsung for confirmation that this particular update will be included in November.
When that update is released, you should check for CVE-2024-43047 in the fixes list, and also whether your device is following the monthly update schedule. If not, and if you have reason to be concerned about spyware or other phone compromises, you should be especially careful given the warnings from Google and Amnesty.
Affected chipsets
Qualcomm
The above list of affected chipsets is extensive, but it will be the different generations of Snapdragon, including the Snapdragon 8 (Gen 1), that will be of particular concern and impact several Samsung devices. Here you can check if yours is on that list.