Log in Start free

Actively exploited · Published Jun 11, 2021 · Assigned by Samsung Mobile

CVE-2021-25394

Medium 6.4 Exploited

In plain English

A medium-severity use-after-free in Samsung Mobile Devices from Samsung Mobile. Attackers are actively exploiting it in the wild (listed by CISA on June 29, 2023). The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.4%top 65.4% of all CVEs
Exploited in the wildYesCISA KEV since Jun 29, 2023
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

Federal agencies must remediate by Jul 20, 2023.

Official description

A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised.

Affected products (as reported)

VendorProductVersions
Samsung Mobile Samsung Mobile Devices O(8.x), P(9.0), Q(10.0), R(11.0) – before SMR MAY-2021 Release 1

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References