Samsung Mobile Devices: Arbitrary Code Execution and Privilege Escalation via Jack Audio Service (SVE-2016-5953)

CVE-2016-11038 · CRITICAL Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered on Samsung mobile devices with software through 2016-04-05 (incorporating the Samsung Professional Audio SDK). The Jack audio service doesn't implement access control for shared memory, leading to arbitrary code execution or privilege escalation. The Samsung ID is SVE-2016-5953 (July 2016).

Learn more about our Cis Benchmark Audit For Mobile Devices.