CVE-2021-25416: Input Validation
Published Jun 11, 2021
·Updated
Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executable kernel page outside code area.
Affected Software
6 affected components
Google Android=10.0
Google Android=11.0
Samsung Exynos 9610
Samsung Exynos 9810
Samsung Exynos 9820
Samsung Exynos 9830
Event History
Jun 11, 2021
CVE Published
via MITRE·02:33 PM
Data Sourced
via MITRE·02:33 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2021-25416.
2
What is the severity of CVE-2021-25416?
The severity of CVE-2021-25416 is medium with a severity value of 6.5.
3
Which software is affected by CVE-2021-25416?
Google Android versions 10.0 and 11.0 are affected by CVE-2021-25416.
4
How can local attackers exploit CVE-2021-25416?
Local attackers can exploit CVE-2021-25416 by assuming EL1 is compromised and creating an executable kernel page outside the code area.
5
Is Samsung Exynos 9610/9810/9820/9830 vulnerable to CVE-2021-25416?
No, Samsung Exynos 9610/9810/9820/9830 are not vulnerable to CVE-2021-25416.