Samsung Mobile Devices Race Condition Vulnerability

Technical Severity

CVSS v3.1 Metrics

MEDIUM

6.4 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

0.46 %

Predictive Probability

Percentile Rank

63.8 th

Documented as more likely to be exploited than 63.8% of known CVEs.

Detection Date

Jun 29, 2023

Remediation Due

Jul 20, 2023

CISA Catalog Active

Threat Analysis

Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.

Remediation Directive

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

External Intelligence

https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2021-25394