CVE-2023-21477: 
NixOS vulnerability analysis and mitigation

CVE-2023-21477 is an out-of-bounds read vulnerability in the TIGERF trustlet on Samsung Android devices, classified under CWE-125 (Access of Memory Location After End of Buffer). It allows local attackers with low privileges to access protected data by reading beyond the allocated buffer boundary. The vulnerability affects Samsung Android versions 11, 12, and 13 prior to the SMR Apr-2023 Release 1 security update. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, though ENISA's EUVD rates it at 7.9 under a different vector accounting for broader scope and higher privilege impact (Samsung Security, ENISA EUVD).

The root cause is an out-of-bounds read (CWE-125) in the TIGERF trustlet, a trusted execution environment (TEE) component running in Samsung's ARM TrustZone. The flaw occurs when the trustlet accesses memory beyond the end of an allocated buffer, potentially exposing data from protected memory regions. Exploitation requires local access with low privileges and no user interaction, making it a post-authentication, local privilege-adjacent attack. No public proof-of-concept code or detailed technical write-ups have been identified at this time (Samsung Security, ENISA EUVD).

Successful exploitation allows a local attacker to read protected data from memory regions managed by the TIGERF trustlet within Samsung's TrustZone TEE. The primary impact is a high confidentiality loss — sensitive data such as cryptographic keys, credentials, or other protected assets stored in the secure enclave could be exposed. There is no integrity or availability impact reported. The scope of affected assets is limited to Samsung devices running Android 11, 12, or 13 prior to the April 2023 SMR patch (Samsung Security, ENISA EUVD).

No public exploit code, exploit kits, or weaponized tools have been identified for CVE-2023-21477. There is no evidence of in-the-wild exploitation, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported (ENISA EUVD).

Samsung addressed this vulnerability in the SMR Apr-2023 Release 1 security update for Android 11, 12, and 13. Users and administrators should apply the April 2023 Samsung security patch immediately by navigating to Settings > Software Update on affected devices. No configuration-based workarounds have been published; patching is the only recommended remediation (Samsung Security).