CVE-2019-6744

Samsung Knox Secure Folder Lock Screen Bypass Vulnerability

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung Galaxy S9 build G9600ZHS3ARL1 Secure Folder. An attacker must first obtain physical access to the device in order to exploit this vulnerability. The specific flaws exists within the the handling of the lock screen for Secure Folder. The issue results from the lack of proper validation that a user has correctly authenticated. An attacker can leverage this vulnerability to disclose the contents of the secure container. Was ZDI-CAN-7381.

Esta vulnerabilidad permite a atacantes locales revelar información confidencial sobre las instalaciones afectadas de Samsung Knox versión 1.2.02.39, en Samsung Galaxy S9 build G9600ZHS3ARL1 Secure Folder. Un atacante primero debe obtener acceso físico al dispositivo a fin de explotar esta vulnerabilidad. Los fallos específicos se presentan en el manejo de la pantalla de bloqueo para Secure Folder. El problema resulta de la falta de comprobación apropiada que un usuario ha autenticado correctamente. Un atacante puede aprovechar esta vulnerabilidad para revelar el contenido del contenedor seguro. Fue ZDI-CAN-7381.

This vulnerability allows local attackers to disclose sensitive information on vulnerability installations of Samsung Secure Folder. An attacker must first obtain physical access to the device in order to exploit this vulnerability.
The specific flaws exists within the the handling of the lock screen for Secure Folder. The issue results from the lack of proper validation that a user has correctly authenticated. An attacker can leverage this vulnerability to disclose the contents of the secure container.

*Credits: James dean

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-01-24 CVE Reserved
2019-05-29 CVE Published
2023-03-08 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-284: Improper Access Control
CWE-287: Improper Authentication

CAPEC

References (2)

URL	Tag	Source
https://security.samsungmobile.com/securityUpdate.smsb	Not Applicable
https://www.zerodayinitiative.com/advisories/ZDI-19-515	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Samsung Search vendor "Samsung"	Knox Search vendor "Samsung" for product "Knox"	1.2.02.39 Search vendor "Samsung" for product "Knox" and version "1.2.02.39"	-	Affected	in	Samsung Search vendor "Samsung"	Galaxy S9 Search vendor "Samsung" for product "Galaxy S9"	-	-	Safe