CVE-2023-21492: Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
Other sources
Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Samsung mobile devices running Android 11, 12, and 13to a version that resolves this vulnerability.Patch SMR May-2023 Release 1
Event History
Frequently Asked Questions
What is CVE-2023-21492?
CVE-2023-21492 is a vulnerability that affects Samsung mobile devices running Android 11, 12, and 13.
How does CVE-2023-21492 affect Samsung mobile devices?
CVE-2023-21492 allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass by inserting sensitive information into a log file.
What can a privileged, local attacker do using CVE-2023-21492?
A privileged, local attacker can bypass address space layout randomization (ASLR).
Which Samsung mobile devices are affected by CVE-2023-21492?
Samsung mobile devices running Android 11, 12, and 13 are affected by CVE-2023-21492.
How can I mitigate the CVE-2023-21492 vulnerability on my Samsung mobile device?
To mitigate the CVE-2023-21492 vulnerability, install the security updates provided by Samsung.