CVE-2021-25369

CVE-2021-25369 is an improper access control flaw (CWE-200) in the sec_log file on Samsung mobile devices, which exposes sensitive kernel information to userspace on devices prior to the March 2021 Samsung security release (SMR MAR-2021 Release 1). It is triggered locally: a low-privileged user or app on the device can read the insufficiently protected sec_log file (local attack vector, no user interaction required). An attacker gains disclosure of sensitive kernel information; the standalone impact is moderate (CVSS 3.1 score 5.5, confidentiality-only), but such kernel info leaks are commonly useful as a reconnaissance or bypass component in a broader exploit chain. All Samsung mobile devices running Android with a security patch level older than SMR MAR-2021 Release 1 are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-11-08), and related reporting indicates a surveillance vendor exploited Samsung phone zero-days, though no public PoC is known.

What to do: Update affected Samsung devices to SMR MAR-2021 Release 1 or any later monthly security update, and verify on each device (Settings > About phone > Software information) that the Android security patch level is March 2021 or newer. Because exploitation is confirmed (CISA KEV) and this flaw requires local access, prioritize patching devices used by high-risk individuals and review which apps have permission to read device logs.