Samsung lists December 2024 patch's security fixes before rollout

Recently, a second November security update surprised Galaxy S24, Galaxy S24 Plus, and Galaxy S24 Ultra owners. Upon receiving the notification, many likely assumed they were receiving the December patch. The company has not yet started the rollout of the latter, but it is already paving the way. Samsung has disclosed the vulnerabilities fixed in the December 2024 security patch for Galaxy devices.

The November 2024 monthly security bulletin for Samsung devices includes numerous code names for the vulnerabilities. There are fixes from both Google and Samsung. Only the vulnerabilities fixed by Samsung include more specific details. Google’s fixes only show their code name and severity.

List of vulnerabilities fixed in Samsung’s December 2024 security patch

The Google fixes are divided into “Critical” and “High” severity categories. The list of fixes for “Critical” vulnerabilities includes CVE-2024-38408, CVE-2024-43096, CVE-2024-43770, CVE-2024-43771, CVE-2024-49747, and CVE-2024-49748.

The list of “High” severity vulnerabilities is quite a bit longer. Here we have CVE-2024-34747, CVE-2024-40671, CVE-2024-34729, CVE-2024-31337, CVE-2023-35659, CVE-2023-35686, CVE-2024-23715, CVE-2024-36978, CVE-2024-46740, CVE-2024-20106, CVE-2024-20104, CVE-2024-23385, CVE-2024-38403, CVE-2024-38424, CVE-2024-38415, CVE-2024-38423, CVE-2024-38421, CVE-2024-21455, CVE-2024-43047, CVE-2024-38405, CVE-2024-43762, CVE-2024-43764, CVE-2024-43769, CVE-2024-43767, CVE-2024-43097, CVE-2024-43768, CVE-2024-43766, CVE-2024-43763.

The security bulletin also mentions the vulnerability “CVE-2024-38402” as fixed in previous patches.

Regarding Samsung Mobile, the company has fixes ready for six vulnerabilities. The list includes SVE-2024-1485 (CVE-2024-49410) which has a description of “Out-of-bounds write in libswmfextractor.so.” Then there is SVE-2024-1808 (CVE-2024-49411) which represents a “Path Traversal in ThemeCenter.” There is also SVE-2024-1845 (CVE-2024-49415) which enables potential attacks via “Out-of-bound write in libsaped.so.”

The vulnerability SVE-2024-1885 (CVE-2024-49412) caused “Improper input validation in Settings.” There’s also the SVE-2024-2044(CVE-2024-49413) which resulted in “Improper Verification of Cryptographic Signature in SmartSwitch.” The latest vulnerability fixed by Samsung Mobile is the SVE-2024-2166(CVE-2024-49414) which allowed “Authentication Bypass Using an Alternate Path in Dex Mode.”

A couple only affect Exynos-powered devices

Last but not least, Samsung Semiconductor has fixed a couple of vulnerabilities. This means that they were exclusively associated with Exynos-powered devices. However, the company does not include a description, simply listing them as CVE-2024-39343 and CVE-2024-39890.

It’s noteworthy that this is not the full changelog for the December 2024 patch. There is still no information about potential new improvements or new features that the update may include. However, seeing how busy Samsung is with One UI 7, it will probably be a patch focused solely on security fixes. The next big One UI update will arrive in January alongside the Galaxy S25 lineup.