PT-2022-22972 · Samsung · Samsung Mtower

C01Dkit · Published 2022-08-04 · Updated 2022-08-10 · CVE-2022-35858

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung mTower version 0.3.0

Description The issue allows a trusted application to trigger a memory overwrite, denial of service, and information disclosure by invoking the function TEE PopulateTransientObject with a large number in the parameter attrCount. This is due to the vulnerable functions TEE PopulateTransientObject and utee from attr in Samsung mTower.

Recommendations For Samsung mTower version 0.3.0, consider disabling the TEE PopulateTransientObject function until a patch is available to prevent potential memory overwrites, denial of service, and information disclosure. Restrict access to the utee from attr function to minimize the risk of exploitation. Avoid using the parameter attrCount in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2022-35858

Affected Products

Samsung Mtower

References · 6

• 🔥 https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/lib/libutee/tee_api_objects.c#L283 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35858 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35858 · Vendor Advisory
• https://github.com/Samsung/mTower/issues/71 · Note
• https://t.me/cibsecurity/47590 · Telegram Post
• https://t.me/cvenotify/34499 · Telegram Post