Samsung Email 应用程序在 SMR 二月 2021 发布版 1 之前的版本中存在劫持漏洞，攻击者可以拦截提供程序执行时。

The hijacking vulnerability in Samsung Email allows an attacker to intercept the execution of providers. This means that if a user interacts with a provider within the email application (e.g., opening a specific attachment or link), the attacker could potentially inject malicious code or redirect the execution flow. The impact could range from data theft (accessing sensitive information within emails) to more severe consequences like remote code execution, depending on the provider's functionality and the attacker's capabilities. While the specific attack vectors are not detailed in the CVE description, the potential for provider hijacking presents a significant security risk.

Users of Samsung Android devices running versions of the Samsung Email application prior to SMR Feb-2021 Release 1 are at risk. This includes individuals who have not updated their email application and those who rely on the application for sensitive communications. Shared devices or enterprise deployments using older versions of the application are particularly vulnerable.

• android / app: Monitor Samsung Email app logs for unusual provider execution patterns. Use Android Debug Bridge (ADB) to inspect app permissions and identify any suspicious modifications. • android / app: Check for unauthorized modifications to the Samsung Email application package using tools like APK Analyzer. • android / system: Review system logs for any unexpected network connections originating from the Samsung Email application. Use adb logcat to filter for relevant events. • android / system: Utilize Android's security features, such as SELinux, to enforce stricter access controls and limit the application's capabilities.

1. 2021-03-04Disclosure

   disclosure

1. 已保留2021-01-19
2. 发布日期2021-03-04
3. 修改日期2024-08-03
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2021-25347 is to immediately upgrade the Samsung Email application to SMR Feb-2021 Release 1 or later. This update contains the necessary fixes to prevent the provider hijacking vulnerability. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider restricting user access to potentially malicious providers or implementing stricter email filtering policies. Monitor email traffic for unusual provider execution patterns. After upgrading, confirm the fix by attempting to trigger a provider execution and verifying that it behaves as expected without any signs of interception or malicious activity.