PT-2021-16606 · Rkp · Rkp

Hard · Published 2021-06-11 · Updated 2021-06-16 · CVE-2021-25415

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: RKP prior to SMR JUN-2021 Release 1

Description: An improper address validation in RKP allows local attackers to remap EL2 memory as writable, assuming EL1 is compromised. This issue enables attackers to potentially escalate privileges or execute malicious code.

Recommendations: For RKP prior to SMR JUN-2021 Release 1, update to SMR JUN-2021 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive memory regions to minimize the risk of exploitation.

Fix

Code Injection

RCE

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

CVE-2021-25415

Affected Products

Rkp

References · 4

• https://osv.dev/vulnerability/CVE-2021-25415 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25415 · Security Note
• https://t.me/cvenotify/16191 · Telegram Post