PT-2021-6224 · Samsung · Android Keystore

Alon Shakevsky + 2 · Published 2021-05-25 · Updated 2022-08-01 · CVE-2021-25444

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android Keystore versions prior to SMR AUG-2021 Release 1

Description The issue is related to an IV reuse vulnerability in the keymaster, which allows decryption of custom keyblobs with privileged processes. This vulnerability is associated with insufficient input validation in the Android Keystore system on Samsung Galaxy devices. The exploitation of this vulnerability may enable an attacker to bypass protection and extract private keys from a secure environment.

Recommendations For versions prior to SMR AUG-2021 Release 1, consider disabling the keymaster function temporarily until a patch is available. Restrict access to the vulnerable keymaster module to minimize the risk of exploitation. Avoid using the affected keyblob in the keymaster until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

RCE

Weakness Enumeration

CWE-330

CWE-20

Related Identifiers

BDU:2022-01145

CVE-2021-25444

Affected Products

Android Keystore

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-25444 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01145 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25444 · Vendor Advisory
• https://t.me/ruheight/1134 · Telegram Post
• https://t.me/cvenotify/34072 · Telegram Post
• https://t.me/true_secator/2682 · Telegram Post
• https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=8 · Note