CVE-2021-25370
Samsung Mobile Devices Memory Corruption Vulnerability
Description
CVE-2021-25370 is a memory corruption vulnerability in the dpu (Display Processing Unit) driver of Samsung Android Mobile Devices, present in versions prior to SMR Mar-2021 Release 1. The vulnerability arises from an incorrect implementation handling file descriptors — specifically a use-after-free (CWE-416) weakness combined with improper exception handling (CWE-703) — that causes memory corruption leading to a kernel panic. A physically present, highly privileged attacker can exploit CVE-2021-25370 to achieve kernel code execution or crash the device. CISA has confirmed active exploitation of this vulnerability and added it to the Known Exploited Vulnerabilities catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| samsung | android | 8.0; 8.1; 9.0; 10.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
References
- https://security.samsungmobile.com(Vendor Advisory)
- https://security.samsungmobile.com/securityUpdate.smsb(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25370(US Government Resource)
Weakness Type
CWE-416: Use After Free
CWE-416 describes a weakness where memory is freed and then subsequently referenced or used, leading to unpredictable behavior including memory corruption. In CVE-2021-25370, the dpu driver incorrectly handles file descriptors, freeing associated memory while still holding references to it, which corrupts kernel memory structures.
Learn more: CWE-416 — Use After Free
CWE-703: Improper Check or Handling of Exceptional Conditions
CWE-703 describes failures to properly handle exceptional states or error conditions. In this vulnerability, the dpu driver fails to correctly validate or recover from exceptional file descriptor states, compounding the use-after-free condition and making kernel panic the result.
Learn more: CWE-703 — Improper Check or Handling of Exceptional Conditions
Impact Analysis
CVE-2021-25370 carries a CVSS 3.1 score of 6.1 (Medium), but the technical impact across all three pillars is severe at the kernel level. Attack Vector (Physical): exploitation requires physical access to the Samsung device, significantly limiting the attacker pool but making it relevant in targeted scenarios such as device seizure or insider threats. Attack Complexity (High): exploiting this vulnerability is technically demanding and may require specific device states or timing conditions. Privileges Required (High): the attacker must already have highly privileged access to the Android system. Confidentiality, Integrity, and Availability (all High): successful exploitation results in memory corruption leading to kernel panic (system crash), and potentially arbitrary kernel code execution — giving an attacker complete control over the device's kernel, all data, and system functions. The combination of use-after-free and kernel-level impact makes this a serious vulnerability despite its Medium CVSS rating due to the restrictive access requirements.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-25370 against Samsung Mobile Devices, placing it in the Known Exploited Vulnerabilities catalog with a remediation deadline of November 29, 2022. No exploit-tagged references appear in the available references, and no public proof-of-concept code has been identified. The EPSS score of 0.239% (47th percentile) reflects moderate exploitation probability compared to the broader CVE population. Given the high attack complexity and physical access requirement, exploitation is likely limited to sophisticated, targeted attacks — potentially state-sponsored actors or forensics tools targeting specific individuals' devices. CVE-2021-25370 may be chained with CVE-2021-25369 (information disclosure in sec_log) to combine information leakage with memory corruption for a more complete device compromise.
Remediation
- Apply Samsung SMR MAR-2021 Release 1 — Samsung's March 2021 Security Maintenance Release contains the fix for CVE-2021-25370 by correcting the file descriptor handling in the dpu driver. Apply this update immediately to all affected Samsung Android devices.
- If the update cannot be applied, discontinue use — Per CISA's KEV required action: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
- Enforce physical security controls — Since exploitation requires physical device access, enforce policies requiring screen lock, full-disk encryption, and secure boot on Samsung Android devices to reduce the exploitability window.
- Apply MDM-enforced security update policies — Use Mobile Device Management solutions to verify and enforce that all managed Samsung devices have applied the March 2021 SMR or later.
- Monitor for device anomalies — Monitor managed device fleets for unexpected kernel panics or reboots, which may indicate exploitation attempts of memory corruption vulnerabilities like CVE-2021-25370.
Technical Details
CVE-2021-25370 is rooted in the display processing unit (dpu) kernel driver on Samsung Android devices, where incorrect file descriptor lifecycle management leads to a use-after-free condition (CWE-416). When the driver frees memory associated with a file descriptor but fails to properly nullify or invalidate references to it, subsequent operations using those stale references corrupt kernel memory. The improper exception handling weakness (CWE-703) means that when this inconsistent state is encountered, the driver does not gracefully recover — instead triggering a kernel panic that crashes the device. The CVSS vector CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H reflects the physical attack vector, high complexity required, and need for existing high privileges, but also demonstrates that when successfully exploited, all three security properties — confidentiality, integrity, and availability — are fully compromised at the kernel level. Memory corruption in kernel drivers is a well-understood primitive for achieving kernel code execution, making this vulnerability particularly dangerous in targeted attack scenarios.
Frequently Asked Questions
Is CVE-2021-25370 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2021-25370 by adding it to the Known Exploited Vulnerabilities catalog. The remediation deadline was November 29, 2022. While exploitation requires physical access and high privileges, targeted attacks — particularly by sophisticated threat actors — have been observed.
What products are affected by CVE-2021-25370?
CVE-2021-25370 affects Samsung Android Mobile Devices running software versions prior to the SMR MAR-2021 Release 1 (Samsung's March 2021 Security Maintenance Release). The specific component is the dpu (Display Processing Unit) kernel driver included in Samsung's Android customization.
How do I fix CVE-2021-25370?
Apply Samsung's SMR MAR-2021 Release 1 security update, which fixes the incorrect file descriptor handling in the dpu driver. If the update cannot be applied, CISA recommends discontinuing use of the affected device. Refer to Samsung's security advisory at security.samsungmobile.com for version-specific details.
How severe is CVE-2021-25370?
CVE-2021-25370 has a CVSS 3.1 score of 6.1 (Medium severity), which reflects the restrictive exploitation requirements (physical access, high privileges, high complexity). However, successful exploitation can result in kernel panic and potential arbitrary kernel code execution, representing a complete device compromise. The EPSS score of 0.239% places it at the 47th percentile for exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.