CVE-2021-25394: medium-severity vulnerability in Samsung Mobile Devices
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
The MFC charger driver has a bug where it tries to use memory that has already been freed, caused by a timing issue. If an attacker gains radio-level access to the device, they could exploit this to write data anywhere in memory.
A use-after-free vulnerability in the MFC charger driver (pre-SMR MAY-2021 Release 1) arises from a race condition in memory management. Exploitation requires compromise of radio privileges and allows arbitrary memory writes; this could lead to privilege escalation or system compromise depending on the context of the write operation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.