CVE-2021-25337

MEDIUMCISA KEV

Samsung Mobile Devices Improper Access Control Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-25337 has a selected CVSS score of 4.4 (medium); EIP currently links 1 repository PoC. CISA lists CVE-2021-25337 in KEV.

Description

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Nov 8, 2022 · CISA
VulnCheck KEV
Listed · Nov 3, 2020 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 4, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Mobile Devices

Browse Samsung / Mobile Devices
CISAVersion data not supplied

Samsung Mobile Devices

Browse Samsung Mobile / Samsung Mobile Devices
CVE ListSelected P(9.0), Q(10.0), R(11.0) to < SMR Mar-2021 Release 1affected

Proofs of concept

1

Repository PoCs

GitHubCrisZalSa/JustALampNothingElseRepository PoCby CrisZalSa1Exploit29 files

56.7 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains native C++ code implementing a local privilege escalation exploit for Samsung mobile devices, targeting a use-after-free vulnerability in the DECON driver and a clipboard service vulnerability (CVE-2021-25337). It includes JNI functions for heap spraying via Mali GPU driver, overwriting kernel address limit, and inserting malicious XML via SemClipboardProvider.

Backdoor review

No backdoor observed in reviewed code

The supplied text files implement three local privilege escalation exploits targeting Samsung Android devices (CVE-2021-25337 and others). The code performs expected exploit behavior: opening device files, crafting malicious structures, and interacting with system services to achieve privilege escalation. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload aimed at the person running the PoC was observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesC++Java
Target softwareSamsung Mobile DevicesDECON driverMali GPU driverSamsung Clipboard Service
Attack typesuse-after-freeprivilege escalationimproper access control
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code in exploit_decon.cpp and exploit_semclipboard.cpp is designed to actively exploit vulnerabilities (DECON UAF and clipboard service) to achieve privilege escalation and file access, not merely detect or report them. It includes heap spray, kernel structure manipulation, and content provider insertion.

main/jni/exploit_decon.cpp:44-94main/jni/exploit_semclipboard.cpp:12-89

Requirements

  • Requires open file descriptors to DECON and Mali GPU devices, and leaked kernel addresses (k_signalfd_ops, k_addr_limit).main/jni/exploit_decon.cpp:44
  • Requires ability to write a malicious XML file to a specific path and interact with the SemClipboardProvider content provider.main/jni/exploit_semclipboard.cpp:22-25

Observed behavior

  • Triggers a use-after-free in the DECON driver via ioctl, then performs a heap spray using the Mali GPU driver to reclaim the freed memory with a crafted fake file structure.main/jni/exploit_decon.cpp:50-84
  • Overwrites the kernel address limit (addr_limit) by calling signalfd on the dangling file descriptor, aiming to bypass kernel memory access restrictions.main/jni/exploit_decon.cpp:86-91
  • Creates a malicious XML file and inserts it into the Samsung clipboard content provider, likely to exploit improper access control for reading/writing local files.main/jni/exploit_semclipboard.cpp:15-88
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Technique
Payload withheldThe exploit_decon.cpp file implements a kernel UAF exploit to overwrite addr_limit, a standard privilege escalation technique.main/jni/exploit_decon.cpp:44-94
Exploit Technique
Payload withheldThe exploit_ioctl.cpp file contains a placeholder exploit for a hypothetical vulnerable device, consistent with PoC development.main/jni/exploit_ioctl.cpp:14-31
Exploit Technique
Payload withheldThe exploit_semclipboard.cpp file exploits the Samsung clipboard service to write a malicious XML file, matching the described CVE-2021-25337.main/jni/exploit_semclipboard.cpp:13-88
External Reference
Payload withheldREADME.md links to an external analysis document, which is not included in the evidence and cannot be reviewed.README.md:1-2
Review boundaries

What the analysis did not establish

  • Only 4 of 19 text files were included; 15 text files and 10 non-text files were omitted, so the full exploit chain may be incomplete.
  • The exploit_decon.cpp code references leaked kernel addresses as parameters, suggesting a prior information leak phase not fully present in the provided files.
  • The exploit_ioctl.cpp file appears to be a generic placeholder or test stub targeting a non-existent device (/dev/vulnerable_device) and is not part of the primary exploit logic.
  • Only 4 of 29 files in the repository were provided as text; 15 text files and 10 non-text files were omitted from analysis.
  • The external Google Drive link referenced in README.md was not reviewed and its content is unknown.
  • Binary files were flagged as metadata-only and not analyzed for embedded payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4