CVE-2021-25395
Samsung Mobile Devices Race Condition Vulnerability
Description
CVE-2021-25395 is a race condition vulnerability in the MFC charger driver of Samsung Android mobile devices, present in firmware prior to the SMR MAY-2021 Release 1. This flaw allows local attackers who have compromised radio-level privileges to bypass signature verification checks, potentially enabling the loading of unsigned or malicious code into a privileged context. CISA has confirmed active exploitation of CVE-2021-25395 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of July 20, 2023. Although the EPSS score of 0.17% suggests limited widespread exploitation, the confirmed in-the-wild activity against Samsung mobile devices makes timely patching essential.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| samsung | android | 8.1; 9.0; 10.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25395(US Government Resource)
Weakness Type
CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization (Race Condition)
In CVE-2021-25395, a race condition in Samsung's MFC charger driver allows concurrent threads to access shared resources without proper synchronization. This timing-dependent flaw enables an attacker to manipulate the execution flow between the signature verification step and the subsequent code loading operation, effectively bypassing the security check that validates the integrity of loaded components.
Learn more: CWE-362 — Race Condition
Impact Analysis
CVE-2021-25395 carries a CVSS v3.1 score of 6.4 (Medium severity). The vulnerability requires local access (Attack Vector: Local) to the device, meaning remote exploitation over a network is not possible. High attack complexity reflects the difficulty of reliably winning the race condition to bypass the signature check. The attacker must already possess high privileges, specifically compromised radio-level access, though no user interaction is needed to trigger the exploit. Upon successful exploitation, the impact is comprehensive: Confidentiality (High) allows the attacker to read sensitive data and credentials. Integrity (High) enables bypassing signature verification, allowing unsigned or tampered code to be loaded. Availability (High) means the device can be rendered unstable or inoperable. The scope remains unchanged, containing the impact to the vulnerable component. While the EPSS score of 0.17% (38th percentile) indicates low probability of broad automated exploitation, CISA's KEV listing confirms that sophisticated threat actors have successfully exploited this vulnerability in targeted campaigns against Samsung devices.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-25395 by including it in the Known Exploited Vulnerabilities catalog, with a mandated remediation deadline of July 20, 2023. No publicly available exploit code or proof-of-concept has been identified in the referenced advisories, indicating that exploitation has likely been limited to sophisticated, targeted attacks rather than broadly available tooling. The EPSS score of 0.17% (38th percentile) further supports that widespread automated exploitation is unlikely, though the vulnerability remains a credible threat when leveraged by advanced adversaries capable of compromising radio-level privileges. The ransomware association is currently classified as unknown.
Remediation
- Apply the Samsung SMR MAY-2021 Release 1 update immediately on all affected Samsung Android devices. Per CISA's KEV directive: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Audit firmware versions across your Samsung device fleet to identify any devices running firmware older than the May 2021 security patch level. Prioritize updates for devices in high-security environments or those with access to sensitive data.
- Enforce minimum patch levels via MDM (Mobile Device Management) to prevent unpatched devices from accessing corporate resources. Configure compliance policies that flag or quarantine devices below the required patch level.
- Monitor for signs of compromise by reviewing device logs for anomalous kernel activity, unexpected module loading, or signature verification failures. Deploy mobile threat defense solutions that can detect exploitation of kernel-level race conditions.
- Harden mobile device security posture by enabling Samsung Knox Workspace for enterprise environments, enforcing Verified Boot, and restricting sideloading of applications to reduce the attack surface available to adversaries who may attempt to chain this vulnerability with other exploits.
Technical Details
CVE-2021-25395 targets Samsung's MFC (Multi-Function Charger) driver at the kernel level, exploiting a race condition (CWE-362) in the signature verification logic. The vulnerability arises because the driver fails to properly synchronize concurrent access to shared resources during the code signing validation process. An attacker with compromised radio-level privileges can exploit the timing window between the signature check and the subsequent use of the verified component, substituting unsigned or malicious code after the verification passes but before the component is loaded — a classic time-of-check-to-time-of-use (TOCTOU) pattern. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates that while exploitation demands local access, high privileges, and precise timing to win the race, the payoff is full compromise of confidentiality, integrity, and availability within the vulnerable component's scope. This vulnerability shares the same driver component as CVE-2021-25394, which exploits a related use-after-free condition in the same MFC charger driver, suggesting a pattern of insufficient synchronization in this kernel module.
Frequently Asked Questions
Is CVE-2021-25395 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2021-25395 by adding it to the Known Exploited Vulnerabilities catalog. The mandated remediation deadline was July 20, 2023. While the EPSS score of 0.17% suggests limited widespread exploitation, targeted attacks have been documented.
What products are affected by CVE-2021-25395?
CVE-2021-25395 affects Samsung Android mobile devices running firmware prior to the SMR MAY-2021 Release 1. All Samsung devices with the vulnerable MFC charger driver that have not received the May 2021 security update are potentially impacted.
How do I fix CVE-2021-25395?
Update all Samsung Android devices to the SMR MAY-2021 Release 1 or later security patch level. Verify the update by checking the Android security patch level in device settings. If the update cannot be applied, implement compensating controls through Mobile Device Management or discontinue use of the affected device per CISA guidance.
How severe is CVE-2021-25395?
CVE-2021-25395 has a CVSS v3.1 score of 6.4, rated as Medium severity. The vulnerability requires local access, high privileges, and high attack complexity, but successful exploitation fully compromises device confidentiality, integrity, and availability. Its inclusion in CISA's KEV catalog confirms it poses a real-world threat despite the moderate CVSS score.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.