CVE-2021-25370mediumunder attackCWE-703

CVE-2021-25370: medium-severity vulnerability in Samsung Mobile Devices

Published · Updated

Follow this CVE+ Monitor Samsung Mobile Devices

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.1epss 0.9%
from disclosure to weapon
Published on NVDMar 26
CISA KEV+592d
Action required by CISAfederal deadline: 2022-11-29

Apply updates per vendor instructions.

In short

The dpu driver incorrectly manages file descriptors, causing memory corruption that can crash the kernel. This affects systems using the driver before the March 2021 patch.

Technical detail

An improper handling of file descriptors in the dpu driver allows memory corruption through CWE-703 (improper check or handling of exceptional conditions). Exploitation requires local access to interact with the driver; successful exploitation leads to kernel panic and denial of service.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Samsung Mobile · Samsung Mobile Devices
Related CVEs — Samsung Mobile Devices

In the same product, most dangerous first.

CVE-2025-21042HIGHCVE-2025-21042EPSS 35.6%KEVCVE-2021-25337MEDIUMCVE-2021-25337EPSS 2.8%KEVCVE-2023-21492MEDIUMCVE-2023-21492EPSS 2.6%KEVCVE-2025-21043HIGHCVE-2025-21043EPSS 2.2%KEVCVE-2021-25369MEDIUMCVE-2021-25369EPSS 1.1%KEVCVE-2021-25372MEDIUMCVE-2021-25372EPSS 0.8%KEV