CVE-2023-21492

CVE-2023-21492 is an information disclosure flaw in Samsung mobile devices in which kernel pointers are written to the device log file, a classic CWE-532 'sensitive data in logs' issue. Triggering requires local access with high (privileged) privileges; an attacker or app with such access can read the leaked pointers from the log. The disclosed addresses let the attacker defeat ASLR (address space layout randomization), which is typically used as a stepping stone in a local privilege-escalation or kernel-exploitation chain rather than as a standalone compromise. Affected devices are Samsung mobile devices running Android whose security patch level predates the SMR May-2023 Release 1. Exploitation is confirmed in the wild: CISA added the issue to the Known Exploited Vulnerabilities catalog on 2023-05-19, though no public proof-of-concept is known and any ransomware connection is unknown.

What to do: Apply Samsung's SMR May-2023 Release 1 security update or later (check Settings > Software update) and confirm the installed security patch level on managed devices. CISA's KEV entry requires applying vendor updates, so prioritize fleet devices used by high-risk or high-value users. Because exploitation requires local privileged access, there is limited remote exposure, but active in-the-wild exploitation makes prompt patching important.