MEDIUM

CVE-2021-25489

Samsung Android 2021-10-06 CVSS v3.1

CVSS

5.5

KEV

Description

Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.

Summary dbcve.org

A format string vulnerability exists in the modem interface driver of Samsung mobile devices due to missing input validation. An attacker with radio permission can exploit this to trigger a format string bug that causes a kernel panic (denial of service).

Mitigation

Update the device to the SMR (Security Maintenance Release) October 2021 or later, which contains the patched modem interface driver with proper input validation.

Weakness (CWE)

CWE-20 Improper Input Validation

CWE-134

EPSS Score

0.53%

Probability of exploitation in next 30 days

42.4th percentile

References

https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10 Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25489 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE