{"id":"CVE-2021-25369","kind":"vulnerability","aliases":["CVE-2021-25369"],"related":[],"title":"samsung android: An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel…","description":"Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Samsung mobile devices using the Mali GPU driver expose kernel information to userspace through an improper access control flaw in the sec_log file. An attacker with a local foothold gets sensitive kernel data, and the flaw was chained with CVE-2021-25337 and CVE-2021-25370 in exploits.","severity":"medium","cvss":6.2,"epss":null,"exploited":true,"exploited_at":"2022-11-08T00:00:00+00:00","products":[{"name":"Samsung Mobile Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 8.1","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 10.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices","samsung"],"not_affected_if":["unpatched-devices-only"],"how_to_check":null,"fix":"Apply the Samsung security update for your device per vendor instructions, as CISA requires.","status":"open","published_at":"2021-03-26T19:15:12+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:58+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:08:58Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Samsung security update for your device per vendor instructions, as CISA requires.","reach":"local","impact":"medium","summary":"Samsung mobile devices using the Mali GPU driver expose kernel information to userspace through an improper access control flaw in the sec_log file. An attacker with a local foothold gets sensitive kernel data, and the flaw was chained with CVE-2021-25337 and CVE-2021-25370 in exploits.","category":"infrastructure","who_cares":["samsung","android","mobile-devices"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads sensitive kernel data, aiding a chained privilege escalation.","analyst_note":"Find the Samsung security bulletin for the affected patch level and the list of affected models; the KEV entry gives no version or device list.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unpatched-devices-only"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000469,"input_tokens":2841,"output_tokens":370,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':16A,23A,26A,87B,91B,128C,132C '-25337':88B,129C '-25369':24A,27A '-25370':92B,133C '1':18A 'access':5A,62B,104C 'action':136C 'android':2A,32A,34A,36A,38A,39B 'appli':137C 'attack':71B 'chain':84B,125C 'cisa':134C 'contain':101C 'control':6A,63B,105C 'cve':22A,25A,86B,90B,127C,131C 'data':79B 'devic':44B,48B,97C 'devices':30A 'driver':53B 'exploit':40B,94B,111C 'expos':19A,54B,115C 'file':11A,69B,110C 'flaw':64B,82B 'foothold':75B 'get':76B 'gpu':52B,100C 'improp':4A,61B,103C 'inform':56B,118C 'infrastructur':41B 'instruct':141C 'kernel':21A,55B,78B,117C 'local':74B 'log':10A,68B,109C 'mali':51B,99C 'mar':15A 'mobil':43B,47B,96C 'mobile':29A 'mobile-devic':42B 'per':139C 'prior':12A 'releas':17A 'requir':135C 'samsung':1A,28A,31A,33A,35A,37A,45B,46B,95C 'sec':9A,67B,108C 'sensit':20A,77B,116C 'smr':14A 'updat':138C 'use':49B,98C 'userspac':58B,121C 'vendor':140C 'vulner':7A,106C,114C,123C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-03-26T19:15:12+00:00","kev":{"dateAdded":"2022-11-08","dueDate":"2022-11-29","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"mobile.security@samsung.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-25369","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-25369","severity":null,"published_at":"2022-11-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-25369","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25369","severity":null,"published_at":"2021-03-26T19:15:12+00:00","modified_at":"2026-06-17T03:41:57+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}