Half a dozen different Samsung smartphones and tablets are vulnerable to a complete takeover by attackers, according to a posting on the Android software developers' forum XDA Developers.
The problem doesn't seem to be with Android itself, but with the 4410 and 4412 versions of the proprietary Exynos chip that Samsung puts in many of its devices. Samsung also calls those versions the Exynos 4 Dual 45nm and Exynos 4 Quad.
According to various reports, the affected smartphones are some versions of the Samsung Galaxy Note, most or all versions of the Samsung Galaxy Note II, the "international" versions of the Samsung Galaxy SII and SIII, and some models of the Meizu MX, which is made by a Chinese company.
The LTE versions of the Samsung Galaxy SII and SIII do not seem to be affected. Nor are the Samsung Galaxy SII and SIII models sold directly by the major U.S. and Canadian carriers, with the possible exception of Bell Canada's version of the Samsung Galaxy SII.
Regarding the Samsung Galaxy Note II, the AT&T, Verizon Wireless and "international" versions are definitely affected.
Affected tablets include the Samsung Galaxy Tab 7.0 Plus, the Samsung Galaxy Tab 7.7 and the Samsung Galaxy Note 10.1. The Google Nexus 10 is not affected.
On its Exynos showcase page, Samsung also lists the Lenovo LePhone smartphone as using the Exynos 4 Quad chip, but it's not clear whether that phone is affected.
Samsung did not immediately respond to a request for comment.
The flaw allows full takeover of the physical memory, which essentially "roots" the device.
"The security hole is in kernel, exactly with the device /dev/exynos-mem. This device is R/W by all users and give access to all physical memory … what's wrong with Samsung?" wrote XDA poster "alephzain," who apparently discovered the vulnerability and reported it Saturday (Dec. 15).
"The good news is we can easily obtain root on these devices and the bad is there is no control over it."
[ Why You Should Hack Your Android Phone ]
With such control, an attacker could do pretty much anything he wanted to a device, including stealing the user's personal data, monitoring calls, emails, text messages and Web activity and controlling the device remotely.
Another XDA developer who goes by the handle "Chainfire" has risen to the challenge and created an Android app that both exploits the flaw and fixes it.
Called "ExynosAbuse," the app gives the user the option of either installing SuperSU, an advanced management tool for Android meant only for very skilled users, or of plugging the hole.
ExynosAbuse isn't in the official Google Play app store, but a tiny app called Exynos Mem Bug Checker is already there. It promises to check your device to see whether the newly discovered flaw is present.
Before you install any app for your Android device, make sure you scan it with mobile anti-virus software. You shouldn't be running Android without it.