Alon Shakevsky

Name of the Vulnerable Software and Affected Versions: keymaster versions prior to SMR Oct-2021 Release 1 Description: A keyblob downgrade attack in keymaster allows an attacker to trigger an IV reuse issue with a privileged process. Recommendations: For versions prior to SMR Oct-2021 Release 1, update to SMR Oct-2021 Release 1 or later to resolve the issue.

The issue is related to an IV reuse vulnerability in the keymaster, which allows decryption of custom keyblobs with privileged processes. This vulnerability is associated with insufficient input validation in the Android Keystore system on Samsung Galaxy devices. The exploitation of this vulnerability may enable an attacker to bypass protection and extract private keys from a secure environment.