CVE-2021-25395: Samsung Mobile Devices Race Condition Vulnerability

Vulnerability summary

CVE-2021-25395 is a medium (CVSS 6.4) Race Condition vulnerability in Samsung Mobile Devices. It is known to be exploited: CISA lists it, first on 29-06-2023. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 28.9% of scored vulnerabilities.

Timeline

1. 11-06-2021
   PublishedVulnerability first disclosed.
2. 29-06-2023
   Added to CISA KEVSamsung Mobile Devices Race Condition Vulnerability
3. 20-07-2023
   CISA remediation dueApply updates per vendor instructions or discontinue use of the product if updates are unavailable
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.