# CVE-2021-25369: Samsung kernel info leak in sec_log

Samsung's permissive sec_log exposed kmsg WARN_ON backtraces containing task_struct and sys_call_table addresses, leaking KASLR and kernel pointers to system apps.

- Payout: Real-world hack
- Severity: medium
- Program: Samsung Android
- Credited: Maddie Stone
- Disclosed: 2021-03-01
- CVE: CVE-2021-25369
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2021/CVE-2021-25369.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2021-25369
- Tags: domain:mobile domain:oss impact:data-leak impact:privesc kind:incident platform:project-zero sev:medium tech:android tech:linux technique:source-review vuln:info-disclosure vuln:misconfiguration

**Target:** Samsung Exynos kernel sec_log / dumpstate bugreport service
**Root cause:** Samsung's custom dumpstate copied kmsg contents (including WARN_ON backtraces with raw stack) into /data/log/sec_log.log with far more permissive access than /dev/kmsg; an invalid Mali HWCNT ioctl triggers WARN_ON(true).
**Steps:**
1. Open /dev/mali0 and issue `ioctl(dev_mali_fd, 0x40148008, &v4)` to get hwcnt_fd
2. Issue invalid ioctl `ioctl(hwcnt_fd, 0x4004BEFE, 0)` to hit `WARN_ON(true)` in kbasep_vinstr_hwcnt_reader_ioctl default case
3. Trigger bugreport: `setprop dumpstate.options bugreportfull; setprop ctl.start bugreport`
4. Read /data/log/sec_log.log to obtain backtrace containing task_struct and sys_call_table addresses
**How found:** Likely by investigating what sec_log is, then hunting for a reachable WARN_ON whose backtrace includes task_struct and a KASLR-breaking address like sys_call_table.
**Exploitation:** Leaked sys_call_table breaks KASLR; leaked task_struct yields addr_limit pointer enabling arbitrary kernel read/write, used as the info-leak stage of an in-the-wild Samsung exploit chain (with a UAO/PAN bypass technique).
**Escalation:** Chained with kernel privilege escalation after using the leak to defeat KASLR and gain arbitrary kernel r/w.
**Insight:** Vendor logging daemons that duplicate kmsg into world-readable files turn benign WARN_ON splats into KASLR/info leaks; audit custom dumpstate and SELinux ctl.start grants on OEM Android builds.