CVE-2021-25489
Published on October 6, 2021
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.
Known Exploited Vulnerability
This Samsung Mobile Devices Improper Input Validation Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.
The following remediation steps are recommended / required by July 20, 2023: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Vulnerability Analysis
CVE-2021-25489 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Use of Externally-Controlled Format String
The software uses a function that accepts a format string as an argument, but the format string originates from an external source.
Products Associated with CVE-2021-25489
You can be notified by stack.watch whenever vulnerabilities like CVE-2021-25489 are published in these products:
What versions are vulnerable to CVE-2021-25489?
Each of the following must match for the vulnerability to exist.