#VU69231 Improper access control in Samsung Mobile Firmware - CVE-2021-25369

Vulnerability identifier: #VU69231

Vulnerability risk: Medium

CVSSv4.0: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2021-25369

CWE-ID: CWE-284

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Samsung Mobile Firmware
Mobile applications / Mobile firmware & hardware

Vendor: Samsung

Description

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions to the sec_log file. A local application can read the log file and obtain sensitive system information.

Note, the vulnerability is being actively exploited in the wild.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Samsung Mobile Firmware: before SMR-MAR-2021

---

External links
https://security.samsungmobile.com/securityUpdate.smsb#SMR-MAR-2021
https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.