CVE-2021-25372
Samsung Mobile Devices Improper Boundary Check Vulnerability
Description
CVE-2021-25372 is an out-of-bounds write vulnerability caused by improper boundary checking in the DSP (Digital Signal Processor) driver of Samsung Android mobile devices, present in firmware prior to the SMR Mar-2021 Release 1. This flaw allows an attacker with physical access and elevated privileges to access memory beyond intended boundaries, potentially corrupting kernel data or executing arbitrary code. CISA has added CVE-2021-25372 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 1.00% (77th percentile), this Samsung DSP driver vulnerability represents a credible threat that warrants immediate patching.
KEV Information
CVSS Score
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| samsung | android | 10.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://security.samsungmobile.com(Vendor Advisory)
- https://security.samsungmobile.com/securityUpdate.smsb(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
In CVE-2021-25372, the Samsung DSP driver fails to properly validate boundary conditions when processing input, allowing write operations to occur beyond the intended memory buffer. This out-of-bounds write can corrupt adjacent memory structures, potentially enabling an attacker to modify kernel data, hijack control flow, or execute arbitrary code within the context of the DSP driver.
Learn more: CWE-787 — Out-of-bounds Write
CWE-703: Improper Check or Handling of Exceptional Conditions
The root cause of CVE-2021-25372 lies in the DSP driver's failure to properly check exceptional conditions, specifically boundary limits on memory access operations. The driver does not adequately validate input parameters before using them to calculate memory offsets, allowing crafted input to trigger memory access beyond allocated boundaries without raising an error or exception.
Learn more: CWE-703 — Improper Check or Handling of Exceptional Conditions
Impact Analysis
CVE-2021-25372 carries a CVSS v3.1 score of 6.1 (Medium severity). The vulnerability requires physical access (Attack Vector: Physical) to the target Samsung device, which substantially narrows the attacker population. High attack complexity reflects the difficulty of reliably exploiting the out-of-bounds memory access, and high privileges are required, meaning the attacker must already have elevated access on the device. No user interaction is needed to trigger the vulnerability. Despite these prerequisites, successful exploitation has severe consequences: Confidentiality (High) means sensitive data in kernel memory, including cryptographic keys, authentication tokens, and user data, could be read. Integrity (High) indicates the attacker can write to arbitrary memory locations, enabling modification of kernel data structures or code injection. Availability (High) means the DSP subsystem or the entire device could be crashed or rendered inoperable. The scope is unchanged, containing the impact within the DSP driver component. The EPSS score of 1.00% (77th percentile) indicates a moderate exploitation probability, and CISA's KEV listing confirms real-world exploitation, likely in conjunction with CVE-2021-25371 which targets the same DSP driver.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-25372 by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of July 20, 2023. No publicly available exploit code or proof-of-concept is referenced in the vendor advisories, indicating that exploitation has been conducted through private, targeted campaigns likely by advanced threat actors. The EPSS score of 1.00% (77th percentile) suggests moderate exploitation probability. This vulnerability is closely related to CVE-2021-25371, which targets hidden functionality in the same Samsung DSP driver; when chained together, these two vulnerabilities enable an attacker to both load arbitrary code into the DSP (via CVE-2021-25371) and corrupt memory boundaries (via CVE-2021-25372), creating a more powerful combined attack against Samsung mobile devices. The ransomware association is currently classified as unknown.
Remediation
- Apply the Samsung SMR Mar-2021 Release 1 update to all affected Samsung Android devices. Per CISA's KEV directive: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Audit all Samsung devices in your fleet to verify the Android security patch level is March 2021 or later. Prioritize devices in high-security environments or those used by personnel with access to sensitive information.
- Implement strict physical security controls for Samsung devices, particularly in environments where device tampering is a concern. Use tamper-evident cases, restrict device access in secure facilities, and implement chain-of-custody procedures for devices that leave secure areas.
- Deploy mobile threat detection solutions that can identify anomalous DSP driver behavior, unexpected memory access patterns, or signs of kernel-level exploitation. Monitor device health through Samsung Knox and MDM platforms for integrity violations.
- Implement robust input validation practices across mobile device deployments by enforcing verified boot, enabling ASLR (Address Space Layout Randomization), and using Samsung Knox security policies to harden the kernel against out-of-bounds memory access attacks.
Technical Details
CVE-2021-25372 exploits an improper boundary check in Samsung's DSP (Digital Signal Processor) driver, a kernel-level component that manages the device's dedicated signal processing hardware. The vulnerability stems from a combination of out-of-bounds write (CWE-787) and improper exception handling (CWE-703): the driver fails to validate input parameters against expected boundary limits before using them to calculate memory offsets for read and write operations. This allows an attacker to craft input that causes the driver to access memory outside the bounds of allocated buffers, potentially reading sensitive kernel data or writing to arbitrary memory locations. The CVSS vector (AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires physical access, high privileges, and high complexity, consistent with a targeted hardware-level attack. The combination of CWE-787 and CWE-703 is significant because the improper exception handling allows the out-of-bounds condition to proceed silently without triggering kernel protections, making the vulnerability more reliably exploitable than a simple boundary overflow that would typically result in a detectable crash.
Frequently Asked Questions
Is CVE-2021-25372 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2021-25372 by adding it to the Known Exploited Vulnerabilities catalog. The remediation deadline was set for July 20, 2023. The exploitation appears to be targeted, often in conjunction with the related vulnerability CVE-2021-25371 in the same DSP driver.
What products are affected by CVE-2021-25372?
CVE-2021-25372 affects Samsung Android mobile devices running firmware prior to the SMR Mar-2021 Release 1. All Samsung devices with the vulnerable DSP driver component are at risk when an attacker has physical access and elevated privileges.
How do I fix CVE-2021-25372?
Apply the Samsung SMR Mar-2021 Release 1 or later security patch to all affected devices. Verify the update by checking the Android security patch level in device settings. Implement physical security controls and mobile threat detection to provide additional layers of defense.
How severe is CVE-2021-25372?
CVE-2021-25372 has a CVSS v3.1 score of 6.1, rated as Medium severity. The physical access requirement limits broad exploitation, but successful attacks can fully compromise confidentiality, integrity, and availability of the DSP subsystem. The EPSS score of 1.00% (77th percentile) and confirmed KEV status indicate this is a real-world threat, particularly when combined with CVE-2021-25371.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.