Actively exploited · Published Oct 6, 2021 · Assigned by Samsung Mobile
CVE-2021-25487
High 7.3 Exploited
In plain English
A high-severity out-of-bounds read in Samsung Mobile Devices from Samsung Mobile. Attackers are actively exploiting it in the wild (listed by CISA on June 29, 2023). The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
CISA guidance
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Federal agencies must remediate by Jul 20, 2023.
Official description
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Samsung Mobile | Samsung Mobile Devices | O(8.1), P(9.0), Q(10.0), R(11.0) – before SMR Oct-2021 Release 1 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N