CVE-2021-25487 : Lack of boundary checking of a buffer in set_skb

Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.

Published 2021-10-06 18:15:10

Updated 2021-10-13 16:43:22

Source Samsung Mobile

View at NVD, CVE.org

Products affected by CVE-2021-25487

Google » Android » Version: 8.1
cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*
Matching versions
When used together with: Samsung » Exynos » Version: N/A
Google » Android » Version: 9.0
cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*
Matching versions
When used together with: Samsung » Exynos » Version: N/A
Google » Android » Version: 10.0
cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*
Matching versions
When used together with: Samsung » Exynos » Version: N/A
Google » Android » Version: 11.0
cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
Matching versions
When used together with: Samsung » Exynos » Version: N/A

CVE-2021-25487 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Samsung Mobile Devices Out-of-Bounds Read Vulnerability

CISA required action:

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

CISA description:

Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.

Notes:

https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10; https://nvd.nist.gov/vuln/detail/CVE-2021-25487

Added on 2023-06-29 Action due date 2023-07-20

Exploit prediction scoring system (EPSS) score for CVE-2021-25487

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 28 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-25487

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.3	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N	2.0	4.7	Samsung Mobile
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: Low Availability: None
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-25487

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.
Assigned by:
- mobile.security@samsung.com (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2021-25487

https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10

Security Updates Firmware Updates | Samsung Mobile Security
Vendor Advisory

CVEs referencing this url