{"id":"CVE-2021-25370","kind":"vulnerability","aliases":["CVE-2021-25370"],"related":[],"title":"samsung android: An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory…","description":"Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Samsung mobile devices with Mali GPU have a memory corruption flaw in the DPU driver's file descriptor handling that can cause a kernel panic. It was chained with CVE-2021-25337 and CVE-2021-25369 and is listed as exploited in the wild.","severity":"medium","cvss":6.1,"epss":null,"exploited":true,"exploited_at":"2022-11-08T00:00:00+00:00","products":[{"name":"Samsung Mobile Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 8.1","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 11.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices","samsung"],"not_affected_if":["non-samsung-devices"],"how_to_check":"Check the device's security patch level under Settings > About phone > Software information; unknown for which level is fixed.","fix":"Apply the Samsung security update for affected devices per vendor instructions; the specific patched build is unknown from the sources.","status":"open","published_at":"2021-03-26T19:15:12+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:09:01+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:09:01Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Samsung security update for affected devices per vendor instructions; the specific patched build is unknown from the sources.\nunknown","reach":"local","impact":"high","summary":"Samsung mobile devices with Mali GPU have a memory corruption flaw in the DPU driver's file descriptor handling that can cause a kernel panic. It was chained with CVE-2021-25337 and CVE-2021-25369 and is listed as exploited in the wild.","category":"infrastructure","who_cares":["samsung","android","mobile-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker crashes kernel via chained exploit; privilege escalation likely given chain","analyst_note":"Find the Samsung security bulletin for CVE-2021-25370 to confirm fixed patch level and whether the chain yields code execution.","how_to_check":"Check the device's security patch level under Settings > About phone > Software information; unknown for which level is fixed.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["non-samsung-devices"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000491,"input_tokens":2842,"output_tokens":414,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':16A,23A,26A,78B,82B,125C,129C '-25337':79B,126C '-25369':83B,130C '-25370':24A,27A '1':18A 'action':133C 'android':2A,32A,34A,36A,38A,40A,41B 'appli':134C 'caus':69B 'chain':75B,122C 'cisa':131C 'contain':98C 'corrupt':57B,114C 'cve':22A,25A,77B,81B,124C,128C 'descriptor':8A,65B,104C 'devic':46B,50B,94C 'devices':30A 'dpu':10A,61B,106C 'driver':11A,62B,107C 'exploit':42B,88B 'file':7A,64B,103C 'flaw':58B 'gpu':53B,97C 'handl':6A,66B,102C 'implement':5A,101C,110C 'incorrect':4A,100C,109C 'infrastructur':43B 'instruct':138C 'kernel':71B,117C 'lead':115C 'list':86B 'mali':52B,96C 'mar':15A 'memori':21A,56B,113C 'mobil':45B,49B,93C 'mobile':29A 'mobile-devic':44B 'panic':72B,118C 'per':136C 'prior':12A 'releas':17A 'requir':132C 'result':19A,111C 'samsung':1A,28A,31A,33A,35A,37A,39A,47B,48B,92C 'smr':14A 'updat':135C 'use':95C 'vendor':137C 'vulner':120C 'wild':91B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-03-26T19:15:12+00:00","kev":{"dateAdded":"2022-11-08","dueDate":"2022-11-29","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"mobile.security@samsung.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-25370","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-25370","severity":null,"published_at":"2022-11-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-25370","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25370","severity":null,"published_at":"2021-03-26T19:15:12+00:00","modified_at":"2026-06-17T03:41:57+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}