CVE-2021-25342: DoS in SMP sdk for Android

An attacker can exploit this vulnerability by crafting a malicious request that attempts to call a provider that does not exist within the SMP sdk. This can lead to a denial of service, effectively crashing the application or preventing it from performing its intended functions. The impact can range from temporary service disruption to complete application unavailability, potentially affecting user experience and data access. Successful exploitation requires the attacker to be able to influence the application's request flow, which may be possible through malicious input or compromised components.

1. Reserved2021-01-19
2. Published2021-03-04
3. Modified2024-08-03
4. EPSS updated2026-04-02

The primary mitigation for CVE-2021-25342 is to upgrade the SMP sdk to version 3.0.9 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation to prevent the application from attempting to call non-existent providers. While a direct workaround is difficult, carefully reviewing and sanitizing any user-supplied data used to construct provider calls can help reduce the attack surface. After upgrading, confirm the fix by attempting to trigger the vulnerable code path and verifying that it no longer results in a DoS.