Zero-Click Exploit in Google Messages Affecting Galaxy S23 and S24 Models

A security flaw affecting Samsung smartphones has been uncovered, posing a significant risk to user safety. Cybersecurity researchers have detailed a vulnerability in the Monkey’s Audio (APE) decoder, which could allow attackers to execute code without user interaction. The flaw, now patched, highlights the importance of rigorous security measures in mobile devices.

The Vulnerability: CVE-2024-49415

The flaw, identified as CVE-2024-49415 with a CVSS score of 8.1, impacts Samsung devices running Android versions 12, 13, and 14. Classified as a high-severity vulnerability, it results from an out-of-bounds write issue in the libsaped.so library. Samsung acknowledged the flaw in a December 2024 advisory, stating, “Out-of-bounds write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code. The patch adds proper input validation.”

The flaw was discovered by Natalie Silvanovich, a researcher at Google Project Zero, who reported it as a zero-click vulnerability. These types of vulnerabilities are especially dangerous because they do not require any action from the victim, making them highly effective for targeted attacks.

How the Exploit Works

The exploit targets a “fun new attack surface,” as described by Silvanovich. It specifically affects Samsung Galaxy S23 and S24 devices configured with Google Messages using Rich Communication Services (RCS), the default setup for these models.

The attack leverages the transcription service in Google Messages, which decodes incoming audio files locally before users interact with the message. This behavior creates an opportunity for malicious actors to exploit the system.

“The function saped_rec in libsaped.so writes to a dmabuf allocated by the C2 media service, which always appears to have a size of 0x120000,” Silvanovich explained. “While the maximum blocksperframe value extracted by libsapedextractor is limited to 0x120000, saped_rec can write up to three times that amount if the input’s bytes per sample are 24. This means that an APE file with a large blocksperframe size can substantially overflow this buffer.”

Attack Scenario

In a potential attack, a threat actor could send a specially crafted audio message via Google Messages to a target device with RCS enabled. The malicious message would exploit the vulnerability, causing the media codec process (“samsung.software.media.c2”) to crash. This crash could then be leveraged to execute arbitrary code, potentially compromising the device’s security and user data.

Implications and Fixes

Samsung’s December 2024 security patch addresses this vulnerability and underscores the importance of timely updates. The patch implements proper input validation to prevent out-of-bounds writes in the libsaped.so library. Users are strongly encouraged to apply the latest security updates to protect their devices from potential exploitation.

Additionally, the patch resolves another high-severity vulnerability in Samsung’s SmartSwitch software (CVE-2024-49413, CVSS score: 7.1). This flaw allowed local attackers to install malicious applications by exploiting improper cryptographic signature verification. While not as dangerous as the zero-click vulnerability, it further highlights the need for comprehensive security measures.