cyfenced.com →

[ CVE-2023-21492 · Published 4 May 2023 ]

Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability

Exploited · CISA KEV CVSS 4.4 EPSS 3%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-05-19

[ Description ]Official description

Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.

CISA: Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 9 Jun 2023): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References