CVE-2021-25370: Samsung Mobile Devices Memory Corruption Vulnerability
CVSS: 6.1v3.1MediumKEVAnalyzed
Published 26-03-2021Last modified 14-01-2026
Vulnerability summary
CVE-2021-25370 is a medium (CVSS 6.1) Use After Free vulnerability in Samsung Mobile Devices. It is known to be exploited: CISA lists it, first on 08-11-2022. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 58.6% of scored vulnerabilities.
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)EPSS score
0.89%
0%100%
Low · 0.00 pp in 30 daysKEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 26-03-2021PublishedVulnerability first disclosed.
- 08-11-2022Added to CISA KEVSamsung Mobile Devices Memory Corruption Vulnerability
- 29-11-2022CISA remediation dueApply updates per vendor instructions.
- 14-01-2026Last modifiedVulnerability information updated.
Description
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 6.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HSources2 sources · 4.4–6.1
- NVDNIST4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HDiffers
Medium 4.9Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:N/I:N/A:CSourcesSingle source
EPSS trend
Probability
0.89%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
0.00 pp
From 0.89% on 19-09-2026
19-09-202619-10-2026
EPSS score0.89%
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 08-11-2022
- Federal due date
- 29-11-2022
CISA required action
Apply updates per vendor instructions. security.samsungmobile.com/securityUpdate.smsb nvd.nist.gov/vuln/detail/CVE-2021-25370
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
- CWE-703Improper Check or Handling of Exceptional ConditionsThe product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
Affected systems
Samsung1 product
- android8.0 | 8.1 | 9.0:smr-apr-2019-r1 | 9.0:smr-apr-2020-r1 | 9.0:smr-aug-2019-r1 | 9.0:smr-aug-2020-r1 | 9.0:smr-dec-2018-r1 | 9.0:smr-dec-2019-r1 | 9.0:smr-dec-2020-r1 | 9.0:smr-feb-2019-r1 | 9.0:smr-feb-2020-r1 | 9.0:smr-feb-2021-r1 | 9.0:smr-jan-2019-r1 | 9.0:smr-jan-2020-r1 | 9.0:smr-jan-2021-r1 | 9.0:smr-jul-2019-r1 | 9.0:smr-jul-2020-r1 | 9.0:smr-jun-2019-r1 | 9.0:smr-jun-2020-r1 | 9.0:smr-mar-2019-r1 | 9.0:smr-mar-2020-r1 | 9.0:smr-may-2019-r1 | 9.0:smr-may-2020-r1 | 9.0:smr-nov-2018-r1 | 9.0:smr-nov-2019-r1 | 9.0:smr-nov-2020-r1 | 9.0:smr-oct-2018-r1 | 9.0:smr-oct-2019-r1 | 9.0:smr-oct-2020-r1 | 9.0:smr-sep-2019-r1 | 9.0:smr-sep-2020-r1 | 10.0:smr-apr-2020-r1 | 10.0:smr-aug-2020-r1 | 10.0:smr-dec-2019-r1 | 10.0:smr-dec-2020-r1 | 10.0:smr-feb-2020-r1 | 10.0:smr-feb-2021-r1 | 10.0:smr-jan-2020-r1 | 10.0:smr-jan-2021-r1 | 10.0:smr-jul-2020-r1 | 10.0:smr-jun-2020-r1 | 10.0:smr-mar-2020-r1 | 10.0:smr-may-2020-r1 | 10.0:smr-nov-2019-r1 | 10.0:smr-nov-2020-r1 | 10.0:smr-oct-2020-r1 | 10.0:smr-sep-2020-r1 | 11.0:smr-dec-2020-r1 | 11.0:smr-feb-2021-r1 | 11.0:smr-jan-2021-r1
Samsung mobile1 product
- samsung mobile devices≥ Selected O(8.X), P(9.0), Q(10.0), R(11.0), < SMR Mar-2021 Release 1
2 vendors · 2 products
References
3 links- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25370Government ResourceUS Government Resource