CVE-2021-25414: 
NixOS vulnerability analysis and mitigation

CVE-2021-25414 is a security vulnerability discovered in Samsung Contacts application prior to SMR JUN-2021 Release 1. The vulnerability allows local attackers to copy or overwrite arbitrary files with Samsung Contacts privilege through improper sanitization of incoming intent (MITRE).

The vulnerability exists in the activity com.samsung.android.contacts.editor.SetProfilePhotoActivity which is exported in Samsung Contacts app. The activity accepts two attacker-controlled URIs: shared_photo_uri for getting content and temp_photo_uri for saving content. By using the content provider com.samsung.contacts.backup with the authority com.samsung.contacts.backup, an attacker could gain read/write access to arbitrary files specified in the path section of the URI (Oversecured Blog).

The vulnerability allows local attackers to read and write arbitrary files with Samsung Contacts application privileges. This could potentially lead to unauthorized access to sensitive data and file manipulation within the scope of the Samsung Contacts application permissions (Oversecured Blog).

The vulnerability requires local access to exploit. A proof of concept exploit has been demonstrated that allows reading and writing files through the vulnerable activity by leveraging the content provider (Oversecured Blog).

Samsung addressed this vulnerability in the Security Maintenance Release (SMR) for June 2021. Users should update their devices to a version containing SMR JUN-2021 Release 1 or later to protect against this vulnerability (Samsung Mobile Security).