Skip to content

Samsung Mobile Devices Unspecified Vulnerability - 20230703005

Overview

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP. The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

What is the vulnerability?

CVE-2021-25371 - CVSS v3 Base Score: 6.7

What is vulnerable?

The vulnerability exists in the following products:

  • Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830

What has been observed?

CISA added this vulnerabilty in their Known Exploited Vulnerabilties catalog on 29 June 2023. There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.

Recommendation

The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of two weeks as per E8 (refer Patch Management):