CVE-2021-25443 Use after free in Samsung Mobile Devices

Medium 5.3 Published 5 Aug 2021 Updated 3 Aug 2024

A use-after-free flaw in the conn_gadget driver allows attackers to execute arbitrary code or escalate privileges on Samsung mobile devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-25443?

CVE-2021-25443 is a medium-severity use after free vulnerability in Google Android, published on 5 Aug 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker.

Weakness: CWE-416, CWE-825

Which versions are affected by CVE-2021-25443?

It affects 1 product.

Products include Google Android.

How do I fix CVE-2021-25443?

No fix has been published for CVE-2021-25443 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2021-25443 being exploited?

There is no known exploitation of CVE-2021-25443 in the wild and no public exploit code.

All Google Android vulnerabilities

Sources

Also known as GHSA-x457-2qmr-4w7v.