CVE-2021-25394
Samsung Mobile Devices Race Condition Vulnerability
Description
CVE-2021-25394 is a use-after-free vulnerability triggered by a race condition in the MFC charger driver of Samsung Android mobile devices. Present in firmware prior to the SMR MAY-2021 Release 1, this flaw allows an attacker who has already compromised radio-level privileges to perform arbitrary memory writes, potentially gaining full control over the device kernel. CISA has added CVE-2021-25394 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 0.62%, the probability of exploitation remains moderate, but the confirmed real-world usage underscores the urgency of patching Samsung mobile devices against this vulnerability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| samsung | android | 8.1; 9.0; 10.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25394(US Government Resource)
Weakness Type
CWE-416: Use After Free
In the context of CVE-2021-25394, a use-after-free condition arises in Samsung's MFC charger driver when memory that has already been freed is subsequently accessed due to a race condition. This allows an attacker to manipulate the freed memory region and achieve arbitrary writes, potentially leading to kernel-level code execution.
Learn more: CWE-416 — Use After Free
CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization (Race Condition)
The race condition in Samsung's MFC charger driver enables the use-after-free by allowing concurrent threads to access and modify shared memory without proper synchronization. This timing-dependent flaw is the mechanism through which the use-after-free condition is triggered, making exploitation dependent on winning the race between competing operations.
Learn more: CWE-362 — Race Condition
Impact Analysis
CVE-2021-25394 carries a CVSS v3.1 score of 6.4 (Medium severity), reflecting a vulnerability that requires local access to the device and high attack complexity due to the race condition that must be won for successful exploitation. The attacker must hold high privileges (specifically, compromised radio-level access), though no user interaction is required. Despite these prerequisites, the impact upon successful exploitation is severe: Confidentiality (High) means sensitive data stored on the device, including credentials and personal information, could be exposed. Integrity (High) indicates the attacker can perform arbitrary memory writes, enabling modification of kernel data structures or injection of malicious code. Availability (High) means the device could be rendered inoperable or forced into a compromised state. The scope remains unchanged, meaning the impact is confined to the vulnerable component itself. While the EPSS score of 0.62% suggests relatively low automated exploitation probability, CISA's inclusion in the KEV catalog confirms this vulnerability has been actively exploited in targeted attacks against Samsung mobile devices.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-25394 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of July 20, 2023. No public exploit code or proof-of-concept has been identified in the available references, suggesting exploitation has been conducted through private or targeted campaigns rather than widely available tooling. The EPSS score of 0.62% (69th percentile) indicates that while broad automated exploitation is not prevalent, the vulnerability remains a viable target for sophisticated adversaries with the capability to compromise radio-level privileges on Samsung devices. The ransomware association for this vulnerability is currently classified as unknown.
Remediation
- Apply the Samsung SMR MAY-2021 Release 1 update as directed by Samsung's security advisory. Per CISA's KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Verify firmware version on all Samsung Android devices in your environment to ensure the May 2021 security patch level or later is installed. Check under Settings > About phone > Software information > Android security patch level.
- Restrict physical and logical access to device baseband and radio interfaces. Implement Mobile Device Management (MDM) policies that enforce minimum patch levels and prevent enrollment of unpatched devices.
- Monitor for indicators of compromise by reviewing device logs for unusual kernel-level activity, unexpected privilege escalations, or anomalous charger driver behavior. Deploy mobile threat detection solutions capable of identifying kernel exploitation attempts.
- Implement defense-in-depth for mobile devices by enabling Samsung Knox security features, enforcing SELinux policies, and segmenting enterprise mobile devices from critical network resources to limit the blast radius of potential compromise.
Technical Details
CVE-2021-25394 exploits a use-after-free vulnerability (CWE-416) in Samsung's MFC (Multi-Function Charger) driver, a kernel-level component responsible for managing charging operations on Samsung Android devices. The vulnerability is triggered through a race condition (CWE-362) where improper synchronization between concurrent execution paths allows a memory region to be freed by one thread while still being referenced by another. An attacker who has compromised radio-level privileges on the device can manipulate the timing of these operations to access the freed memory, enabling arbitrary write primitives in kernel space. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires local access with high privileges and high attack complexity due to the precise timing required to win the race condition. The combination of CWE-416 and CWE-362 is a well-known exploitation pattern in kernel drivers, where race conditions serve as the trigger mechanism for use-after-free conditions that ultimately provide the attacker with powerful memory corruption capabilities.
Frequently Asked Questions
Is CVE-2021-25394 being actively exploited?
Yes, CISA has added CVE-2021-25394 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The remediation deadline set by CISA was July 20, 2023, indicating the urgency for organizations to patch affected Samsung mobile devices.
What products are affected by CVE-2021-25394?
CVE-2021-25394 affects Samsung Android mobile devices running firmware prior to the SMR MAY-2021 Release 1. All Samsung devices with the vulnerable MFC charger driver that have not been updated to the May 2021 security patch level are potentially at risk.
How do I fix CVE-2021-25394?
Apply the Samsung SMR MAY-2021 Release 1 security update or later to all affected devices. Verify the Android security patch level is set to May 2021 or newer. If updates cannot be applied, consider discontinuing use of the affected device or implementing compensating controls through MDM policies.
How severe is CVE-2021-25394?
CVE-2021-25394 has a CVSS v3.1 score of 6.4 (Medium severity). While the attack requires local access, high privileges, and precise timing, successful exploitation grants full control over device confidentiality, integrity, and availability. The EPSS score places it in the 69th percentile, and its presence in the KEV catalog confirms real-world exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.