CVEvulnerability

CVE-2021-25370

4.4 MEDIUM Known exploited Published 2021-03-26 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Samsung Mobile Devices Memory Corruption Vulnerability — Samsung Mobile Devices

Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.

Added to KEV
2022-11-08
Remediation due
2022-11-29
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://security.samsungmobile.com/securityUpdate.smsb; https://nvd.nist.gov/vuln/detail/CVE-2021-25370
Status
Analyzed
Published
2021-03-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
4.4 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.9 MEDIUM — AV:L/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-416, CWE-703

Description

An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.

Affected configurations

• samsung android 8.0 • samsung android 8.1 • samsung android 9.0 • samsung android 10.0 • samsung android 11.0

Related

Weakness · CWE (2)

  • CWE-416 Use After Free weakness
  • CWE-703 Improper Check or Handling of Exceptional Conditions weakness

References