PT-2021-16657 · Unknown · Vision Dsp Kernel Driver

Gyorgy Miru · Published 2021-10-06 · Updated 2021-12-16 · CVE-2021-25467

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Vision DSP kernel driver versions prior to SMR Oct-2021 Release 1

Description: The issue allows for privilege escalation to Root by hijacking loaded library, assuming system privilege is gained. This is due to possible buffer overflow vulnerabilities in the Vision DSP kernel driver.

Recommendations: For versions prior to SMR Oct-2021 Release 1, update to SMR Oct-2021 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Vision DSP kernel driver to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2021-25467

Affected Products

Vision Dsp Kernel Driver

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-25467 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25467 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/4985 · Telegram Post
• https://t.me/pentestingnews/15791 · Telegram Post
• https://t.me/cibsecurity/30094 · Telegram Post