SMP sdk 在 3.0.9 版本之前调用不存在的提供者，允许未经授权的操作，包括通过劫持提供者发起拒绝服务攻击。

An attacker can exploit this vulnerability by crafting a malicious request that attempts to call a provider that does not exist within the SMP sdk. This can lead to a denial of service, effectively crashing the application or preventing it from performing its intended functions. The impact can range from temporary service disruption to complete application unavailability, potentially affecting user experience and data access. Successful exploitation requires the attacker to be able to influence the application's request flow, which may be possible through malicious input or compromised components.

Android applications that utilize the SMP sdk and are running versions 3.0.9 or earlier are at risk. This includes applications that rely on the sdk for specific functionalities and those that handle user input that could be manipulated to trigger the vulnerability. Developers using the SMP sdk in their projects should prioritize upgrading to the patched version.

• android / app:

# Check for SMP sdk version
Get-Package -Name com.example.myapp | Select-Object Version

• android / app:

# Check for suspicious provider calls in logs (replace 'provider_name' with actual provider name)
adb logcat | grep -i "provider_name"

1. 2021-03-04Disclosure

   disclosure

1. 已保留2021-01-19
2. 发布日期2021-03-04
3. 修改日期2024-08-03
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2021-25342 is to upgrade the SMP sdk to version 3.0.9 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation to prevent the application from attempting to call non-existent providers. While a direct workaround is difficult, carefully reviewing and sanitizing any user-supplied data used to construct provider calls can help reduce the attack surface. After upgrading, confirm the fix by attempting to trigger the vulnerable code path and verifying that it no longer results in a DoS.