CVE-2023-21492
KEVSamsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability
Description
Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NPublishedMay 4, 2023
Last modifiedJun 17, 2026
Added to KEVMay 19, 2023
Remediation dueJun 9, 2023
References
- security.samsungmobile.com/securityUpdate.smsb?year=2023&month=05Vendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21492US Government Resource
0 recent articles mention this CVE
52
Risk assessment · Medium
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1236 days
- CVSS
- 4.4 MEDIUM
- EPSS (30-day exploit probability)
- 2.6% · top 15% of all CVEs
- Weakness
- CWE-532
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.