CVE-2021-25337
MEDIUM KEVSamsung mobile <SMR Mar-2021 Release 1 - Info Disclosure
Title source: llmExploitation Summary
CVE-2021-25337 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 8, 2022. EIP tracks 1 public exploit from researchers including CrisZalSa.
AI-analyzed exploit summary This repository contains functional exploit code for CVE-2021-25337, targeting a use-after-free (UAF) vulnerability in Samsung's DECON driver. The exploit leverages heap spraying via Mali GPU's MEM_PROFILE_ADD ioctl to achieve arbitrary write and bypass addr_limit for privilege escalation.
Description
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
Exploits (1)
This repository contains functional exploit code for CVE-2021-25337, targeting a use-after-free (UAF) vulnerability in Samsung's DECON driver. The exploit leverages heap spraying via Mali GPU's MEM_PROFILE_ADD ioctl to achieve arbitrary write and bypass addr_limit for privilege escalation.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N