Samsung patched CVE-2024-44068 (CVSS 8.1), a high-severity use-after-free vulnerability in Exynos chipsets (9820, 9825, 980, 990, 850, and W920). Discovered by Google Threat Analysis Group (TAG) and Devices & Services researchers, the flaw resides in the m2m1shot_scaler0 hardware-accelerated media scaler driver. The bug stems from page reference counting discrepancies during M2M1SHOT_IOC_PROCESS IOCTL calls: PFNMAP pages fail to increment reference counts, while unmapping triggers decrements, leaving I/O virtual mappings pointing to freed physical memory pages.

Google TAG confirmed active in-the-wild exploitation by commercial spyware operators within targeted privilege escalation chains. Attackers exploited the dangling physical page mapping to achieve arbitrary code execution inside the privileged cameraserver process, renaming the compromised thread to vendor.samsung.hardware.camera.provider@3.0-service to evade forensic detection. Samsung addressed the flaw in its October 2024 Security Maintenance Release by enforcing strict reference counting across driver memory mappings.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Driver-level use-after-free flaws in SoC hardware acceleration modules bypass user-space Android sandboxes, allowing local non-privileged actors to corrupt physical memory, seize media server privileges, and spoof system services without triggering kernel crash telemetry.
• Bullet 2 — Strategic & Defender Imperative: Mobile fleet administrators must prioritize deploying the SMR-Oct-2024 firmware update across all affected Exynos-powered handsets, while endpoint detection platforms should monitor camera provider service namespaces for abnormal process metadata or unexpected parent-child execution lineages.