Is CVE-2016-1919 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-1919 being exploited in the wild.

How severe is CVE-2016-1919?

Medium severity, with a CVSS score of 4.7, published 27 January 2017.

Is there a fix for CVE-2016-1919?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-1919 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2016-1919?

Check whether you run Samsung Knox. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-1919: Samsung KNOX weak eCryptFS key generation in KNOX 1.0

CVE-2016-1919 · Severity: medium · CVSS 4.7 · Published 2017-01-27

Samsung KNOX 1.0, a security platform for mobile devices, uses a flawed method for generating encryption keys to protect stored data. An attacker with local access to the device can exploit this weakness to bypass encryption and access sensitive files, such as application data and SD card contents. This vulnerability effectively allows unauthorized access to private information that the user believes is securely encrypted.

Technologies: Samsung Knox. Vendors: Samsung.

Quick answers

Is CVE-2016-1919 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-1919 being exploited in the wild.
How severe is CVE-2016-1919?: Medium severity, with a CVSS score of 4.7, published 27 January 2017.
Which products and versions are affected?: Samsung KNOX 1.0.0.
Is there a fix for CVE-2016-1919?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-1919 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2016-1919?: Check whether you run Samsung Knox. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Samsung KNOX 1.0 utilizes a weak eCryptFS key generation algorithm that XORs a 32-byte TIMA key with a space-padded user password before Base64 encoding the result. Due to a logic error where the Base64 string is truncated to 32 bytes, only the first 24 bytes of the XORed sequence contribute to the final key. Because passwords shorter than 8 characters result in identical padding for the first 24 bytes, the encryption key remains static regardless of the password chosen, or requires minimal brute-forcing for slightly longer passwords. An attacker with local root or system-level access can retrieve the TIMA key via the ITimaService and decrypt the container data. The issue was addressed in KNOX 2.3.0 by implementing a more robust key generation scheme.

Affected products

Samsung KNOX 1.0.0

Timeline

2015-12-09: disclosed: Vendor contacted by researchers
2016-01-16: advisory: Public disclosure via Bugtraq mailing list
2017-01-27: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.