CVE-2023-21419

Vulnerability

An improper implementation logic in Secure Folder on Samsung devices prior to the SMR Jan-2023 Release 1 (including firmware versions released before January 2023) allows the container to remain unlocked under a specific, undefined condition. This flaw resides in the Secure Folder application's lock management code.

Exploitation

An attacker needs to meet the unspecified condition that causes the Secure Folder to remain unlocked. The nature of the condition is not detailed in available references, but logical access to the device may be sufficient if the condition is met. No special privileges or user interaction beyond normal operation is required.

Impact

Successful exploitation enables an attacker to access the contents of the Secure Folder without authentication, bypassing the intended security boundary. This could lead to disclosure of sensitive files (photos, documents, apps) stored within the container.

Mitigation

Samsung released a fix as part of the SMR Jan-2023 Release 1 update [1]. Users should ensure their device’s security patch level is January 2023 or later. No workarounds are documented.