Actively exploited in the wild
Samsung Mobile Devices Out-of-Bounds Read Vulnerability
Samsung - Mobile Devices · Listed in the CISA KEV since 2023-06-29. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
CVE-2021-25487
HighCVSS 7.3KEVSummary
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.
Risk Assessment
Enables arbitrary code execution on the device, potentially leading to full compromise of the modem or system. Critical for mobile devices with the vulnerable modem.
Recommendation
Apply the SMR Oct-2021 Release 1 or later update provided by the device vendor. Contact the vendor to obtain the patch.
Other vulnerabilities in Modem interface driver
Original NVD description (English source)
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS