Following the Android security bulletin, Samsung has now detailed its April 2023 One UI patch, applicable on Galaxy devices. Along with Google patches, the company included additional SVE fixes related to Smart Suggestions, Phone, Exynos flaws, and more.
On March 30, Samsung started releasing the April 2023 security patch to Galaxy devices, starting the S23 series. Throughout the month, supported Galaxy devices will continue to receive the latest software update, which includes Android plus One UI patches together.
Smart Suggestions Flaw
SVE-2022-2907(CVE-2023-21479)
Improper authorization in Smart Suggestions before SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a schedule. The patch removes the BROWSABLE attribute and is applicable on devices running Android 13 and Smart Suggestions before 4.1.01.0 in Android 12.
Exynos Flaws
SVE-2022-3004 (CVE-2023-21473) and SVE-2022-3001 (CVE-2023-21472)
Improper input validation with Exynos Fastboot USB Interface before SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in the bootloader. The patch adds proper implementation for arbitrary input with a USB interface.
SVE-2022-2755 (CVE-2023-21467)
Error in 3GPP specification implementation in Exynos baseband before SMR Apr-2023 Release 1 allows incorrect handling of the unencrypted message. The patch adds proper authentication logic to the devices equipped with Exynos chipsets.
Apart from the above-mentioned SVE items, Samsung patched more vulnerabilities that may have affected your Galaxy device, check full documentation here. Moreover, the update includes patches that Google listed in April 2023 Android security bulletin.
April patch brings fixes to a number of common vulnerability exposures including but not limited to 5 Critical, 46 High, and 1 Moderate. Notably, Google found 4 more vulnerabilities, which are not applicable to Samsung Galaxy devices.
