CVE-2023-21492: Samsung Android kernel pointer logging enables ASLR bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

medium priorityIt is a local, high-privilege information leak with known exploitation per KEV, but it requires an existing privileged foothold and only enables ASLR bypass rather than direct compromise.

What it is

Samsung Android devices log kernel pointers to a log file before the SMR May-2023 Release 1 fix. A privileged local attacker who can read those logs learns kernel memory layout, defeating ASLR. The flaw is an information leak, not code execution, but it weakens a core exploit mitigation.

Impact

An attacker with local privileged access gains kernel address information that can be used to bypass ASLR and improve the reliability of a follow-on kernel exploit. There is no direct confidentiality, integrity or availability loss beyond the leaked addresses.

Attack surface

Reached locally on the device; the CVSS vector requires high privileges (PR:H) and no user interaction (UI:N). The attacker must already have a privileged local foothold and the ability to read the affected log file.

Exploitation

CISA added it to KEV on 2023-05-19 with a 2023-06-09 remediation due date, indicating known exploitation, while EPSS is low at 0.02554 (84th percentile). No ransomware campaign use is documented.

What to do

• Apply the Samsung SMR May-2023 Release 1 (or later) security update per vendor instructions.
• Restrict read access to device log files and log buffers to the minimum set of privileged processes.
• Disable or reduce verbose kernel logging on production devices where policy allows.
• Monitor for and investigate any local privileged process reading kernel log files.
• Track KEV remediation deadlines and verify patch status across the Samsung Android fleet.

Detection

• Alert on privileged processes reading kernel log files or log buffers outside expected system components.
• Audit device logs for kernel pointer values (0xffff... style addresses) appearing in log output.
• Monitor for post-exploitation behavior that follows an ASLR bypass, such as kernel exploit attempts.
• Verify patch level on managed Samsung Android devices against the May-2023 SMR baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.