CVE-2021-25477: Double Free
An improper error handling in Mediatek RRC Protocol stack prior to SMR Oct-2021 Release 1 allows modem crash and remote denial of service.
Other sources
In Modem LTE RRC, there is a possible memory corruption due to a double free. This could lead to remote denial of service when decoding an incorrect ASN.1 data with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in SoCVersion:2022-04-05 - Upgrade
Upgrade
Mediatek RRC Protocol stackto a version that resolves this vulnerability.Fixed in SMR Oct-2021 Release 1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25477?
CVE-2021-25477 has a high severity rating due to its potential to cause modem crashes and remote denial of service.
How do I fix CVE-2021-25477?
To fix CVE-2021-25477, users should update their Android devices to a version released after the October 2021 security patch.
Which Android versions are affected by CVE-2021-25477?
CVE-2021-25477 affects Android versions 9.0, 10.0, and 11.0.
What are the consequences of CVE-2021-25477?
The consequences of CVE-2021-25477 include a potential remote denial of service that can disrupt device functionality.
Is CVE-2021-25477 specific to MediaTek devices?
CVE-2021-25477 is related to improper error handling in the Mediatek RRC Protocol stack but affects specific versions of Android on MediaTek chipsets.