Vulnerability-Lookup

CVE-2021-25372 (GCVE-0-2021-25372)

Vulnerability from cvelistv5 – Published: 2021-03-26 18:25 – Updated: 2026-01-14 14:51

CISA Previdian

Summary

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-04 21:24 UTC

CWE

CVE-703: Improper Check or Handling of Exceptional Conditions
CWE-703 - Improper Check or Handling of Exceptional Conditions

Assigner

Samsung Mobile CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

3 references

URL	Tags
https://security.samsungmobile.com/securityUpdate.smsb	x_refsource_CONFIRM
https://security.samsungmobile.com	x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version	CPE status
Samsung Mobile	Samsung Mobile Devices	Affected: Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830 , < SMR Mar-2021 Release 1 (custom)	guessed

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 17b325fe-5478-4fd1-9563-ae7e0457ba79

Vulnerability ID: CVE-2021-25372

Status: Confirmed

Status Updated: 2023-06-29 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2023-06-29

Asserted: 2023-06-29

Scope

Notes: Samsung Mobile Devices Improper Boundary Check Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable | Due date: 2023-07-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=3; https://nvd.nist.gov/vuln/detail/CVE-2021-25372

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-787
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Mobile Devices
Due Date	2023-07-20
Date Added	2023-06-29
Vendorproject	Samsung
Vulnerabilityname	Samsung Mobile Devices Improper Boundary Check Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2021-25372

Created: 2026-02-02 12:26 UTC | Updated: 2026-11-04 13:35 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 06138742-c971-49e0-8086-4a097db786ef

Vulnerability ID: CVE-2021-25372

Status: Confirmed

Status Updated: 2023-06-29 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2023-06-29

Asserted: 2023-06-29

Scope

Notes: KEVIntel entry: An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access. | Affected: Samsung Mobile / Samsung Mobile Devices | CVSS: 6.1 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.
Vendor	Samsung Mobile
Product	Samsung Mobile Devices
Added Date	2023-06-29T00:00:00.000Z
Cvss Score	6.1
Epss Score	None
Cvss Severity	MEDIUM
Epss Percentile	None
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	False

References

Created: 2026-06-23 14:05 UTC | Updated: 2026-07-10 06:14 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:03:05.515Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.samsungmobile.com/securityUpdate.smsb"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.samsungmobile.com"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-25372",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T21:24:54.412179Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-06-29",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-703",
                "description": "CWE-703 Improper Check or Handling of Exceptional Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T14:51:22.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Samsung Mobile Devices",
          "vendor": "Samsung Mobile",
          "versions": [
            {
              "lessThan": "SMR Mar-2021 Release 1",
              "status": "affected",
              "version": "Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CVE-703: Improper Check or Handling of Exceptional Conditions",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-26T18:25:04.000Z",
        "orgId": "3af57064-a867-422c-b2ad-40307b65c458",
        "shortName": "Samsung Mobile"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.samsungmobile.com/securityUpdate.smsb"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.samsungmobile.com"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "mobile.security@samsung.com",
          "ID": "CVE-2021-25372",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Samsung Mobile Devices",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830",
                            "version_value": "SMR Mar-2021 Release 1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Samsung Mobile"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CVE-703: Improper Check or Handling of Exceptional Conditions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.samsungmobile.com/securityUpdate.smsb",
              "refsource": "CONFIRM",
              "url": "https://security.samsungmobile.com/securityUpdate.smsb"
            },
            {
              "name": "https://security.samsungmobile.com",
              "refsource": "MISC",
              "url": "https://security.samsungmobile.com"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458",
    "assignerShortName": "Samsung Mobile",
    "cveId": "CVE-2021-25372",
    "datePublished": "2021-03-26T18:25:04.000Z",
    "dateReserved": "2021-01-19T00:00:00.000Z",
    "dateUpdated": "2026-01-14T14:51:22.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2021-25372",
      "cwes": [
        "CWE-787"
      ],
      "dateAdded": "2023-06-29",
      "dueDate": "2023-07-20",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://security.samsungmobile.com/securityUpdate.smsb?year=2021\u0026month=3; https://nvd.nist.gov/vuln/detail/CVE-2021-25372",
      "product": "Mobile Devices",
      "requiredAction": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable",
      "shortDescription": "Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.",
      "vendorProject": "Samsung",
      "vulnerabilityName": "Samsung Mobile Devices Improper Boundary Check Vulnerability"
    },
    "epss": {
      "cve": "CVE-2021-25372",
      "date": "2026-11-14",
      "epss": "0.00804",
      "percentile": "0.57318"
    },
    "fkie_nvd": {
      "cisaActionDue": "2023-07-20",
      "cisaExploitAdd": "2023-06-29",
      "cisaRequiredAction": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable",
      "cisaVulnerabilityName": "Samsung Mobile Devices Improper Boundary Check Vulnerability",
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D558D965-FA70-4822-A770-419E73BA9ED3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "109DD7FD-3A48-4C3D-8E1A-4433B98E1E64",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:samsung:exynos_2100:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9385885D-654A-496E-8029-7C6D9B077193",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:samsung:exynos_980:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0D8701B6-6989-44D1-873A-A1823BFD7CCC",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:samsung:exynos_9830:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CC599902-095F-411E-B112-1BA9A643C6C9",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access."
        },
        {
          "lang": "es",
          "value": "Una comprobaci\u00f3n inapropiada de l\u00edmites en el controlador DSP versiones anteriores a SMR Mar-2021 Release 1, permite un acceso a la memoria fuera de l\u00edmites."
        }
      ],
      "id": "CVE-2021-25372",
      "lastModified": "2024-11-21T05:54:51.697",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "HIGH",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "LOCAL",
              "authentication": "NONE",
              "availabilityImpact": "COMPLETE",
              "baseScore": 7.2,
              "confidentialityImpact": "COMPLETE",
              "integrityImpact": "COMPLETE",
              "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
              "version": "2.0"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 10.0,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "PHYSICAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 0.2,
            "impactScore": 5.9,
            "source": "mobile.security@samsung.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 0.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2021-03-26T19:15:12.303",
      "references": [
        {
          "source": "mobile.security@samsung.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://security.samsungmobile.com"
        },
        {
          "source": "mobile.security@samsung.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://security.samsungmobile.com/securityUpdate.smsb"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://security.samsungmobile.com"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://security.samsungmobile.com/securityUpdate.smsb"
        }
      ],
      "sourceIdentifier": "mobile.security@samsung.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-787"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "cisaActionDue": "2023-07-20",
        "cisaExploitAdd": "2023-06-29",
        "cisaRequiredAction": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable",
        "cisaVulnerabilityName": "Samsung Mobile Devices Improper Boundary Check Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*",
                    "matchCriteriaId": "18C71F11-7599-4AE1-B455-C7A50D8D5F4D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*",
                    "matchCriteriaId": "878AAF2D-E54A-4145-A618-81341ED4B0C8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*",
                    "matchCriteriaId": "25B42CE0-67DE-4611-8D70-DEEC975E32BA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*",
                    "matchCriteriaId": "AC082E25-1B7D-473D-A066-1463E6321CD5",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:samsung:exynos_2100:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9385885D-654A-496E-8029-7C6D9B077193",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:samsung:exynos_980:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0D8701B6-6989-44D1-873A-A1823BFD7CCC",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:samsung:exynos_9830:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC599902-095F-411E-B112-1BA9A643C6C9",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access."
          },
          {
            "lang": "es",
            "value": "Una comprobaci\u00f3n inapropiada de l\u00edmites en el controlador DSP versiones anteriores a SMR Mar-2021 Release 1, permite un acceso a la memoria fuera de l\u00edmites."
          }
        ],
        "id": "CVE-2021-25372",
        "lastModified": "2026-01-14T18:43:48.383",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 7.2,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "COMPLETE",
                "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 10.0,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "PHYSICAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 0.2,
              "impactScore": 5.9,
              "source": "mobile.security@samsung.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-03-26T19:15:12.303",
        "references": [
          {
            "source": "mobile.security@samsung.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://security.samsungmobile.com"
          },
          {
            "source": "mobile.security@samsung.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://security.samsungmobile.com/securityUpdate.smsb"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://security.samsungmobile.com"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://security.samsungmobile.com/securityUpdate.smsb"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372"
          }
        ],
        "sourceIdentifier": "mobile.security@samsung.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-703"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-29T03:59:21+00:00",
      "cve": "CVE-2021-25372",
      "id": "CVE-2021-25372",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2021-25372",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-25372.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T20:03:05.515Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://security.samsungmobile.com/securityUpdate.smsb"
              },
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://security.samsungmobile.com"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-25372",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-04T21:24:54.412179Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2023-06-29",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372"
                  },
                  "type": "kev"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-703",
                    "description": "CWE-703 Improper Check or Handling of Exceptional Conditions",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-04T21:25:03.282Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Samsung Mobile Devices",
              "vendor": "Samsung Mobile",
              "versions": [
                {
                  "lessThan": "SMR Mar-2021 Release 1",
                  "status": "affected",
                  "version": "Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "PHYSICAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CVE-703: Improper Check or Handling of Exceptional Conditions",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2021-03-26T18:25:04.000Z",
            "orgId": "3af57064-a867-422c-b2ad-40307b65c458",
            "shortName": "Samsung Mobile"
          },
          "references": [
            {
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://security.samsungmobile.com/securityUpdate.smsb"
            },
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://security.samsungmobile.com"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "x_generator": {
            "engine": "Vulnogram 0.0.9"
          },
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "mobile.security@samsung.com",
              "ID": "CVE-2021-25372",
              "STATE": "PUBLIC"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "Samsung Mobile Devices",
                          "version": {
                            "version_data": [
                              {
                                "version_affected": "\u003c",
                                "version_name": "Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830",
                                "version_value": "SMR Mar-2021 Release 1"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "Samsung Mobile"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access."
                }
              ]
            },
            "generator": {
              "engine": "Vulnogram 0.0.9"
            },
            "impact": {
              "cvss": {
                "attackComplexity": "HIGH",
                "attackVector": "PHYSICAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "CVE-703: Improper Check or Handling of Exceptional Conditions"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "https://security.samsungmobile.com/securityUpdate.smsb",
                  "refsource": "CONFIRM",
                  "url": "https://security.samsungmobile.com/securityUpdate.smsb"
                },
                {
                  "name": "https://security.samsungmobile.com",
                  "refsource": "MISC",
                  "url": "https://security.samsungmobile.com"
                }
              ]
            },
            "source": {
              "discovery": "UNKNOWN"
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "3af57064-a867-422c-b2ad-40307b65c458",
        "assignerShortName": "Samsung Mobile",
        "cveId": "CVE-2021-25372",
        "datePublished": "2021-03-26T18:25:04.000Z",
        "dateReserved": "2021-01-19T00:00:00.000Z",
        "dateUpdated": "2026-01-14T14:51:22.987Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CNVD-2025-02733

Vulnerability from cnvd - Published: 2025-02-12

Title

Samsung DSP驱动程序越界写入漏洞（CNVD-2025-02733）

Description

Samsung DSP驱动程序是三星（Samsung）移动设备的一个数字信号处理驱动程序。 Samsung DSP驱动程序存在越界写入漏洞，该漏洞源于错误的边界检查，攻击者可利用该漏洞进行越界内存访问。

Severity

高

Patch Name

Samsung DSP驱动程序越界写入漏洞（CNVD-2025-02733）的补丁

Patch Description

Samsung DSP驱动程序是三星（Samsung）移动设备的一个数字信号处理驱动程序。 Samsung DSP驱动程序存在越界写入漏洞，该漏洞源于错误的边界检查，攻击者可利用该漏洞进行越界内存访问。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://security.samsungmobile.com/securityUpdate.smsb

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-25372

Impacted products

Name
['Samsung Samsung Mobile devices Q(10.0)(Exynos 980芯片组)', 'Samsung Samsung Mobile devices Q(10.0) (Exynos 9830芯片组)', 'Samsung Samsung Mobile devices Q(10.0) (Exynos 2100芯片组)', 'Samsung Samsung Mobile devices R(11.0) (Exynos 980芯片组)', 'Samsung Samsung Mobile devices R(11.0) (Exynos 9830芯片组)', 'Samsung Samsung Mobile devices R(11.0) (Exynos 2100芯片组)']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-25372",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-25372"
    }
  },
  "description": "Samsung DSP\u9a71\u52a8\u7a0b\u5e8f\u662f\u4e09\u661f\uff08Samsung\uff09\u79fb\u52a8\u8bbe\u5907\u7684\u4e00\u4e2a\u6570\u5b57\u4fe1\u53f7\u5904\u7406\u9a71\u52a8\u7a0b\u5e8f\u3002\n\nSamsung DSP\u9a71\u52a8\u7a0b\u5e8f\u5b58\u5728\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u9519\u8bef\u7684\u8fb9\u754c\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u8d8a\u754c\u5185\u5b58\u8bbf\u95ee\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://security.samsungmobile.com/securityUpdate.smsb",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-02733",
  "openTime": "2025-02-12",
  "patchDescription": "Samsung DSP\u9a71\u52a8\u7a0b\u5e8f\u662f\u4e09\u661f\uff08Samsung\uff09\u79fb\u52a8\u8bbe\u5907\u7684\u4e00\u4e2a\u6570\u5b57\u4fe1\u53f7\u5904\u7406\u9a71\u52a8\u7a0b\u5e8f\u3002\r\n\r\nSamsung DSP\u9a71\u52a8\u7a0b\u5e8f\u5b58\u5728\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u9519\u8bef\u7684\u8fb9\u754c\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u8d8a\u754c\u5185\u5b58\u8bbf\u95ee\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Samsung DSP\u9a71\u52a8\u7a0b\u5e8f\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\uff08CNVD-2025-02733\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Samsung Samsung Mobile devices Q(10.0)(Exynos 980\u82af\u7247\u7ec4)",
      "Samsung Samsung Mobile devices Q(10.0) (Exynos 9830\u82af\u7247\u7ec4)",
      "Samsung Samsung Mobile devices Q(10.0) (Exynos 2100\u82af\u7247\u7ec4)",
      "Samsung Samsung Mobile devices R(11.0) (Exynos 980\u82af\u7247\u7ec4)",
      "Samsung Samsung Mobile devices R(11.0) (Exynos 9830\u82af\u7247\u7ec4)",
      "Samsung Samsung Mobile devices R(11.0) (Exynos 2100\u82af\u7247\u7ec4)"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-25372",
  "serverity": "\u9ad8",
  "submitTime": "2021-04-01",
  "title": "Samsung DSP\u9a71\u52a8\u7a0b\u5e8f\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\uff08CNVD-2025-02733\uff09"
}

FKIE_CVE-2021-25372

Vulnerability from fkie_nvd - Published: 2021-03-26 19:15 - Updated: 2026-06-17 03:41

CISA Previdian

Severity

6.1 (Medium) - CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

References

URL	Tags
mobile.security@samsung.com	https://security.samsungmobile.com	Vendor Advisory
mobile.security@samsung.com	https://security.samsungmobile.com/securityUpdate.smsb	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.samsungmobile.com	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.samsungmobile.com/securityUpdate.smsb	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372	US Government Resource

Impacted products

Vendor	Product	Version
samsung	android	10.0
samsung	android	10.0
samsung	android	11.0
samsung	android	11.0
samsung	exynos_2100	-
samsung	exynos_980	-
samsung	exynos_9830	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Samsung Mobile Devices",
          "vendor": "Samsung Mobile",
          "versions": [
            {
              "lessThan": "SMR Mar-2021 Release 1",
              "status": "affected",
              "version": "Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "mobile.security@samsung.com"
    }
  ],
  "cisaActionDue": "2023-07-20",
  "cisaExploitAdd": "2023-06-29",
  "cisaRequiredAction": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable",
  "cisaVulnerabilityName": "Samsung Mobile Devices Improper Boundary Check Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*",
              "matchCriteriaId": "18C71F11-7599-4AE1-B455-C7A50D8D5F4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*",
              "matchCriteriaId": "878AAF2D-E54A-4145-A618-81341ED4B0C8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*",
              "matchCriteriaId": "25B42CE0-67DE-4611-8D70-DEEC975E32BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*",
              "matchCriteriaId": "AC082E25-1B7D-473D-A066-1463E6321CD5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:samsung:exynos_2100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9385885D-654A-496E-8029-7C6D9B077193",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:samsung:exynos_980:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D8701B6-6989-44D1-873A-A1823BFD7CCC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:samsung:exynos_9830:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC599902-095F-411E-B112-1BA9A643C6C9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access."
    },
    {
      "lang": "es",
      "value": "Una comprobaci\u00f3n inapropiada de l\u00edmites en el controlador DSP versiones anteriores a SMR Mar-2021 Release 1, permite un acceso a la memoria fuera de l\u00edmites."
    }
  ],
  "id": "CVE-2021-25372",
  "lastModified": "2026-06-17T03:41:57.807",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.2,
        "impactScore": 5.9,
        "source": "mobile.security@samsung.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-25372",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-04T21:24:54.412179Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2021-03-26T19:15:12.303",
  "references": [
    {
      "source": "mobile.security@samsung.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.samsungmobile.com"
    },
    {
      "source": "mobile.security@samsung.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.samsungmobile.com/securityUpdate.smsb"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.samsungmobile.com"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.samsungmobile.com/securityUpdate.smsb"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372"
    }
  ],
  "sourceIdentifier": "mobile.security@samsung.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-703"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-QVJG-564F-22C8

Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2025-10-22 00:32

Details

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

Severity

6.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-25372"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-703",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-26T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.",
  "id": "GHSA-qvjg-564f-22c8",
  "modified": "2025-10-22T00:32:05Z",
  "published": "2022-05-24T17:45:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25372"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/securityUpdate.smsb"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2021-25372

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

Aliases

CVE-2021-25372

Aliases

CVE-2021-25372

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-25372",
    "description": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.",
    "id": "GSD-2021-25372"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-25372"
      ],
      "details": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.",
      "id": "GSD-2021-25372",
      "modified": "2023-12-13T01:23:21.010386Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "mobile.security@samsung.com",
        "ID": "CVE-2021-25372",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Samsung Mobile Devices",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830",
                          "version_value": "SMR Mar-2021 Release 1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Samsung Mobile"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CVE-703: Improper Check or Handling of Exceptional Conditions"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://security.samsungmobile.com/securityUpdate.smsb",
            "refsource": "CONFIRM",
            "url": "https://security.samsungmobile.com/securityUpdate.smsb"
          },
          {
            "name": "https://security.samsungmobile.com",
            "refsource": "MISC",
            "url": "https://security.samsungmobile.com"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:samsung:exynos_2100:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:samsung:exynos_980:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:samsung:exynos_9830:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "mobile.security@samsung.com",
          "ID": "CVE-2021-25372"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-787"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.samsungmobile.com/securityUpdate.smsb",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://security.samsungmobile.com/securityUpdate.smsb"
            },
            {
              "name": "https://security.samsungmobile.com",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://security.samsungmobile.com"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 0.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2021-04-01T19:06Z",
      "publishedDate": "2021-03-26T19:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-25372 (GCVE-0-2021-25372)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

CNVD-2025-02733

FKIE_CVE-2021-25372

GHSA-QVJG-564F-22C8

GSD-2021-25372

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour