cyfenced.com →

[ CVE-2021-25395 · Published 11 Jun 2021 ]

Samsung Mobile Devices Race Condition Vulnerability

Exploited · CISA KEV CVSS 6.4 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-06-29

[ Description ]Official description

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.

CISA: Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 20 Jul 2023): Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References