[ CVE-2021-25372 · Published 26 Mar 2021 ]

Samsung Mobile Devices Improper Boundary Check Vulnerability

Exploited · CISA KEV CVSS 6.7 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-06-29

[ Description ]Official description

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

CISA: Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 20 Jul 2023): Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

security.samsungmobile.comVendor Advisory
security.samsungmobile.com/securityUpdate.smsbVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource