CVE-2021-25487

What it actually does

This is a local memory-corruption flaw in Samsung mobile modem interface driver code before Samsung Mobile Security Release (SMR) Oct-2021 Release 1. The vulnerable set_skb_priv() path lacks adequate boundary checking on a buffer associated with socket-buffer/private modem-interface data. A local attacker with low privileges can trigger an out-of-bounds read that may cause dereference of an invalid or attacker-influenced function pointer, leading to arbitrary code execution in a highly privileged context, likely kernel or driver context. Successful exploitation can provide full compromise of the affected device, including confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can let a malicious local app or attacker with an initial foothold take over an affected Samsung mobile device, bypass normal application isolation, access sensitive data, install persistent tooling, or disrupt device operation. Because the vulnerability is listed in CISA KEV with known in-the-wild exploitation and a remediation deadline of 2023-07-20, unpatched devices should be treated as high-priority legacy exposure even though the EPSS value is currently low and flat. The supplied affected-product metadata references Ubuntu mysql-8.0 fixed in 8.0.28-0ubuntu0.20.04.3, which appears inconsistent with the Samsung modem-driver vulnerability description; asset owners should validate package-to-CVE mappings before relying on that package information for remediation decisions.

How an attack unfolds

An attacker first obtains local execution on an affected Samsung mobile device, commonly through a malicious application, chained exploit, physical access scenario, or another vulnerability that gives code execution under an unprivileged user context. The attacker then interacts with the modem interface driver in a way that reaches set_skb_priv() with malformed or specially sized data. Because the driver does not correctly check buffer boundaries, the code reads outside the intended memory region and can proceed to dereference an invalid function pointer. With a reliable exploit, the attacker redirects execution into attacker-controlled code or a kernel-oriented exploit chain, escalating privileges and gaining broad control over the device. Post-exploitation activity may include credential and token theft, surveillance, persistence, disabling security controls, or using the device as a platform for further compromise. The KEV listing indicates this class of exploit has been observed in the wild, though the provided threat-actor field is a vulnerability label rather than a named adversary group.

How to fix it

Apply Samsung Mobile Security Release Oct-2021 Release 1 or any later vendor firmware/security update for all affected Samsung mobile devices. Prioritize devices that are exposed to untrusted application installation, are used by high-risk users, or have not received security updates since 2021. If a device model can no longer receive Samsung security updates, replace or retire it, restrict it from sensitive workflows, and enforce mobile device management controls such as application allowlisting, work-profile isolation, and blocking sideloaded applications. The input also lists Ubuntu 20.04 mysql-8.0 fixed in version 8.0.28-0ubuntu0.20.04.3; because that product mapping conflicts with the modem-driver vulnerability description, validate the advisory source before treating MySQL package upgrades as remediation for this CVE. If that package mapping is relevant to a separate internal scanner result, update mysql-8.0 on Ubuntu 20.04 LTS to at least 8.0.28-0ubuntu0.20.04.3.

How to confirm the fix worked

Confirm affected Samsung devices report a security patch level including SMR Oct-2021 Release 1 or later. Use MDM, EMM, or device-inventory tooling to collect model, Android security patch level, baseband version, and firmware build identifiers, then compare them against Samsung security bulletin coverage for this issue. For package-based scanner findings that reference Ubuntu mysql-8.0, verify with dpkg/apt metadata that mysql-8.0 is at or above 8.0.28-0ubuntu0.20.04.3, but also confirm whether that package result is a true match to this CVE. Where possible, rerun authenticated vulnerability scans after patching and ensure the finding is no longer reported. For mobile fleets, validate that devices unable to receive the required SMR are blocked, quarantined, or retired.

Typical attack path

1. Identify or acquire access to an affected Samsung mobile device running firmware prior to SMR Oct-2021 Release 1.
2. Gain local code execution or low-privileged app execution on the device through social engineering, app installation, physical access, or an exploit chain.
3. Invoke the vulnerable modem interface driver path that reaches set_skb_priv() using crafted modem/socket-buffer-related inputs.
4. Trigger the out-of-bounds read and invalid function-pointer dereference condition.
5. Use the memory-corruption primitive to execute code in privileged driver or kernel context.
6. Escalate privileges, disable protections, access sensitive data, and optionally deploy persistence or additional payloads.

How to detect it

Look for evidence of prior exploitation in mobile security telemetry, MDM/EMM logs, Android crash reports, kernel logs, baseband/modem logs, and forensic images where available. Useful signals include unexplained kernel oops or panic events involving modem interface drivers, invalid function-pointer dereferences, crashes shortly after modem/network activity, unexpected privilege escalation by an app, suspicious native binaries dropped by apps, SELinux denials followed by abnormal privileged behavior, disabled security controls, or persistence mechanisms created after a crash. Correlate device patch level with crash timing: crashes on devices running firmware older than SMR Oct-2021 Release 1 are more concerning. If the device was used by a high-risk user or shows signs of unknown app installation, sideloading, rooting, or tampering, preserve a forensic image before remediation where operationally feasible. Because public exploit-specific artifacts are not reliably derivable from the advisory alone, detection should emphasize behavioral correlation rather than a single definitive signature.

• set_skb_priv
• invalid function pointer
• Unable to handle kernel NULL pointer dereference
• Unable to handle kernel paging request
• Kernel panic - not syncing
• Internal error: Oops
• BUG: unable to handle kernel
• modem interface driver
• sec_modem
• modem_if
• /proc/kmsg
• /sys/fs/pstore/console-ramoops
• /sys/fs/pstore/console-ramoops-0
• /data/tombstones/
• /data/system/dropbox/
• SYSTEM_TOMBSTONE
• SYSTEM_LAST_KMSG

What your security team should do

• Treat this as a priority historical KEV exposure: identify any Samsung mobile devices missing SMR Oct-2021 Release 1 or later and remediate or retire them.
• Use MDM/EMM inventory to enforce minimum Android security patch levels and block access from devices below the required patch level.
• Investigate devices that show unexpected kernel crashes, modem driver faults, sudden privilege escalation indicators, or suspicious app behavior before patching or reimaging.
• Restrict sideloading and enforce application allowlisting, especially for users handling sensitive data or high-risk communications.
• Validate scanner/package mappings because the supplied mysql-8.0 affected-product data appears inconsistent with the Samsung modem-driver vulnerability description.
• For any Ubuntu mysql-8.0 assets independently flagged by package scanners, update to 8.0.28-0ubuntu0.20.04.3 or later and verify the CVE association with vendor advisories.
• Add detection content for mobile kernel panic/oops messages involving modem interface handling, invalid function pointers, and set_skb_priv where such telemetry is available.
• Review CISA KEV compliance records because the remediation due date was 2023-07-20 and any remaining exposure represents overdue risk.