PT-2025-4170 · Unknown · Libsthmbc.So

Published 2025-02-04 · Updated 2025-02-12 · CVE-2025-20888

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libsthmbc.so versions prior to SMR Jan-2025 Release 1

Description The issue is related to an out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so. This allows local attackers to execute arbitrary code with privilege, requiring user interaction to trigger the issue.

Recommendations For versions prior to SMR Jan-2025 Release 1, update to SMR Jan-2025 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the smp4vtd functionality in libsthmbc.so to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-20888

Affected Products

Libsthmbc.So

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-20888 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20888 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=01 · Vendor Advisory
• https://t.me/cvenotify/111044 · Telegram Post
• https://t.me/cvenotify/109823 · Telegram Post
• https://twitter.com/CVEnew/status/1886680232356397452 · Twitter Post