CVE-2023-37366: Samsung Exynos Processor DoS Vulnerability

CVE-2023-37366 Overview

CVE-2023-37366 affects multiple Samsung Exynos Mobile Processor, Automotive Processor, and Modem products. The vulnerability resides in the Shannon SM Task, where improper handling of a loop with an unreachable exit condition prevents termination of a required service. A malformed Session Management (SM) message triggers the condition, resulting in a denial of service on the affected component. The flaw is classified under [CWE-835] (Loop with Unreachable Exit Condition). Samsung documented the issue in its semiconductor product security advisory portal.

Critical Impact
A local attacker with low privileges can send a malformed SM message to the Shannon modem stack, causing a required service to fail to terminate and degrading availability of the baseband.

Affected Products

Samsung Exynos Mobile Processors: Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920
Samsung Exynos Modems: Exynos Modem 5123, Exynos Modem 5300
Samsung Exynos Automotive Processor: Exynos Auto T5123

Discovery Timeline

2026-09-14 - CVE-2023-37366 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2023-37366

Vulnerability Analysis

The vulnerability exists in the Shannon Session Management (SM) Task, a component of the baseband firmware that handles cellular signaling procedures. When the SM Task processes a malformed SM message, it enters a loop whose exit condition can never be satisfied. The task fails to release resources or terminate, blocking the normal operation of the required service. The attack requires local access with low privileges and no user interaction. The impact is limited to availability, with confidentiality and integrity unaffected.

Root Cause

The root cause is an improper loop termination check inside the Shannon SM Task, tracked as [CWE-835] Loop with Unreachable Exit Condition ("Infinite Loop"). The message parser does not validate structural fields of the SM message sufficiently, allowing malformed input to place the state machine into a code path where the loop condition remains true indefinitely.

Attack Vector

An attacker with local access and low privileges sends a crafted SM message into the baseband processing path. The malformed input steers the SM Task into the vulnerable loop. Because the exit condition cannot be reached, the task continues to consume execution cycles and cannot service further requests. See the Samsung CVE-2023-37366 Advisory for vendor-supplied technical context.

No verified public proof-of-concept code is available for this vulnerability. The exploitation mechanism is described in prose per the vendor advisory rather than reproduced here.

Detection Methods for CVE-2023-37366

Indicators of Compromise

Unexpected loss of cellular connectivity or modem service on devices using the listed Exynos processors or modems.
Repeated baseband resets, watchdog-triggered restarts, or SM Task hangs observed in device logs.
Anomalous local process activity generating malformed Session Management signaling to the modem interface.

Detection Strategies

Monitor mobile device management (MDM) telemetry for spikes in modem crashes or connectivity failures across fleets running affected Exynos hardware.
Correlate baseband firmware fault logs with local application activity to identify processes interacting abnormally with radio interface layers.
Track firmware and patch level inventory to identify devices still exposed to the vulnerable Shannon SM Task.

Monitoring Recommendations

Ingest device health and radio subsystem telemetry into a centralized analytics platform to baseline modem stability.
Alert on repeated SM Task or modem service termination events on the same device within short time windows.
Track vendor security bulletins from Samsung Semiconductor for updates that address CVE-2023-37366.

How to Mitigate CVE-2023-37366

Immediate Actions Required

Inventory devices and automotive platforms running the affected Exynos processors and modems listed in the Samsung advisory.
Apply the firmware and baseband updates distributed by device manufacturers that incorporate Samsung's Shannon SM Task fix.
Restrict installation of untrusted local applications on affected devices that could deliver malformed SM messages to the baseband.

Patch Information

Samsung has published remediation information through its semiconductor product security portal. Refer to the Samsung CVE-2023-37366 Advisory and the general Samsung Product Security Updates page for firmware versions and downstream OEM integration guidance. End users should install the corresponding vendor OTA update once made available by the device manufacturer.

Workarounds

No vendor-published workaround replaces the firmware update; applying the Samsung-supplied patch is the definitive remediation.
Limit local attack surface by enforcing strict application allowlists on managed mobile and automotive endpoints until patches are deployed.
For automotive deployments using the Exynos Auto T5123, coordinate with the vehicle OEM for validated firmware rollouts.

bash

# Example: verify firmware/build information on an Android device using an affected Exynos SoC
adb shell getprop ro.build.version.release
adb shell getprop ro.build.version.security_patch
adb shell getprop gsm.version.baseband