[ CVE-2021-25369 · Published 26 Mar 2021 ]
Samsung Mobile Devices Improper Access Control Vulnerability
Exploited · CISA KEV CVSS 5.5
EPSS 1%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-11-08
[ Description ]Official description
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.
CISA: Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 29 Nov 2022): Apply updates per vendor instructions.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- security.samsungmobile.comVendor Advisory
- security.samsungmobile.com/securityUpdate.smsbVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource