Llamada a un proveedor inexistente en el SMP sdk anterior a la versión 3.0.9 permite acciones no autorizadas, incluyendo un ataque de denegación de servicio al secuestrar el proveedor.

An attacker can exploit this vulnerability by crafting a malicious request that attempts to call a provider that does not exist within the SMP sdk. This can lead to a denial of service, effectively crashing the application or preventing it from performing its intended functions. The impact can range from temporary service disruption to complete application unavailability, potentially affecting user experience and data access. Successful exploitation requires the attacker to be able to influence the application's request flow, which may be possible through malicious input or compromised components.

Android applications that utilize the SMP sdk and are running versions 3.0.9 or earlier are at risk. This includes applications that rely on the sdk for specific functionalities and those that handle user input that could be manipulated to trigger the vulnerability. Developers using the SMP sdk in their projects should prioritize upgrading to the patched version.

• android / app:

# Check for SMP sdk version
Get-Package -Name com.example.myapp | Select-Object Version

• android / app:

# Check for suspicious provider calls in logs (replace 'provider_name' with actual provider name)
adb logcat | grep -i "provider_name"

1. 2021-03-04Disclosure

   disclosure

1. Reservado2021-01-19
2. Publicada2021-03-04
3. Modificada2024-08-03
4. EPSS actualizado2026-04-02

The primary mitigation for CVE-2021-25342 is to upgrade the SMP sdk to version 3.0.9 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation to prevent the application from attempting to call non-existent providers. While a direct workaround is difficult, carefully reviewing and sanitizing any user-supplied data used to construct provider calls can help reduce the attack surface. After upgrading, confirm the fix by attempting to trigger the vulnerable code path and verifying that it no longer results in a DoS.