CVE-2021-25487

2021-10-0617:10:26

CWE-125

Samsung Mobile

www.cve.org

7.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

0.001 Low

EPSS

Percentile

29.5%

JSON

Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.

CNA Affected

[
  {
    "product": "Samsung Mobile Devices",
    "vendor": "Samsung Mobile",
    "versions": [
      {
        "lessThan": "SMR Oct-2021 Release 1",
        "status": "affected",
        "version": "O(8.1), P(9.0), Q(10.0), R(11.0)",
        "versionType": "custom"
      }
    ]
  }
]