CVE-2023-21492mediumunder attackCWE-532

CVE-2023-21492: medium-severity vulnerability in Samsung Mobile Devices

Published · Updated

Follow this CVE+ Monitor Samsung Mobile Devices

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 4.4epss 2.6%
from disclosure to weapon
Published on NVDMay 4
CISA KEV+15d
Action required by CISAfederal deadline: 2023-06-09

Apply updates per vendor instructions.

In short

The system logs kernel memory addresses in plain text, allowing a privileged attacker on the same machine to predict where code is located in memory and bypass security protections.

Technical detail

CWE-532 (Information Exposure through Log Files) enables a privileged local attacker to read kernel pointers from log files, defeating ASLR (Address Space Layout Randomization) protections. The vulnerability requires local access and elevated privileges but compromises a fundamental memory randomization defense mechanism.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
Samsung Mobile · Samsung Mobile Devices
Related CVEs — Samsung Mobile Devices

In the same product, most dangerous first.

CVE-2025-21042HIGHCVE-2025-21042EPSS 35.6%KEVCVE-2021-25337MEDIUMCVE-2021-25337EPSS 2.8%KEVCVE-2025-21043HIGHCVE-2025-21043EPSS 2.2%KEVCVE-2021-25369MEDIUMCVE-2021-25369EPSS 1.1%KEVCVE-2021-25370MEDIUMCVE-2021-25370EPSS 0.9%KEVCVE-2021-25372MEDIUMCVE-2021-25372EPSS 0.8%KEV