CVE-2021-25371
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
Medium
Known exploited
- Severity
- 6.7 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.80%
- Chance of exploitation in the next 30 days. Higher than 56.65% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Jun 29, 2023
- Weakness
- CWE-912 Hidden Functionality
- Fix
- None yet
- No fixed version published
Exploited in the wild. Samsung Mobile Devices Unspecified Vulnerability (Samsung Mobile Devices). Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable Due for U.S. federal agencies by Jul 20, 2023.
Description
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 6.7
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-912: Hidden Functionality
The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
How to prevent it
- Installation: Always verify the integrity of the product that is being installed.
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9wfr-w7mm-pc7f Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference | High | Same weakness, CWE-912 |
| CVE-2025-47729 The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different… | Medium Known exploited | Same weakness, CWE-912 |
| CVE-2024-20439 A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static… | Critical Known exploited | Same weakness, CWE-912 |
| GHSA-j9cw-5cpj-9qj5 Moodle has a Hidden Functionality vulnerability | Medium | Same weakness, CWE-912 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor