// For flags

CVE-2021-25370

Samsung Mobile Devices Memory Corruption Vulnerability

Severity Score

4.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

Yes
*KEV

Decision

-
*SSVC
Descriptions

An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.

Un descriptor de archivo con manejo de implementación incorrecta en el controlador dpu versiones anteriores a SMR Mar-2021 Release 1, resulta en una corrupción de memoria que conlleva a un pánico del kernel.

Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Physical
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-01-19 CVE Reserved
  • 2021-03-26 CVE Published
  • 2022-11-08 Exploited in Wild
  • 2022-11-29 KEV Due Date
  • 2023-03-08 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- First Exploit
CWE
  • CWE-416: Use After Free
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Google
Search vendor "Google"
 Android
Search vendor "Google" for product "Android"
 8.0
Search vendor "Google" for product "Android" and version "8.0"
-
Affected
Google
Search vendor "Google"
 Android
Search vendor "Google" for product "Android"
 8.1
Search vendor "Google" for product "Android" and version "8.1"
-
Affected
Google
Search vendor "Google"
 Android
Search vendor "Google" for product "Android"
 9.0
Search vendor "Google" for product "Android" and version "9.0"
-
Affected
Google
Search vendor "Google"
 Android
Search vendor "Google" for product "Android"
 10.0
Search vendor "Google" for product "Android" and version "10.0"
-
Affected
Google
Search vendor "Google"
 Android
Search vendor "Google" for product "Android"
 11.0
Search vendor "Google" for product "Android" and version "11.0"
-
Affected