CVE-2021-25370 · netVigilance record NV22-0539
Samsung Mobile Devices Memory Corruption
past due
What to do
Apply updates per vendor instructions.
CISA deadline 2022-11-29 · passed 3 years 9 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA
What happened
Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.
Who is affected
Samsung Mobile Devices. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.
Weakness class: CWE-416.
Timeline
- Added to CISA KEVExploitation in the wild confirmed by CISA
- CISA remediation deadlinepassed 3 years 9 months ago
Sources
- NVD entry for CVE-2021-25370 nvd.nist.gov/vuln/detail/CVE-2021-25370
- CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
- security.samsungmobile.com security.samsungmobile.com/securityUpdate.smsb
- nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2021-25370