#VU69232 Use-after-free in Samsung Mobile Firmware - CVE-2021-25370

Vulnerability identifier: #VU69232

Vulnerability risk: High

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2021-25370

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Samsung Mobile Firmware
Mobile applications / Mobile firmware & hardware

Vendor: Samsung

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the dpu driver. A local application can trigger a use-after-free error and execute arbitrary code with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Samsung Mobile Firmware: before SMR-MAR-2021

---

External links
https://security.samsungmobile.com/securityUpdate.smsb#SMR-MAR-2021
https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.