PT-2022-23515 · Samsung · Mtower

Published 2022-09-01 · Updated 2022-09-07 · CVE-2022-36622

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Samsung Electronics mTower versions 0.3.0 and earlier

Description The issue is related to a NULL pointer dereference via the function TEE GetObjectInfo1(). This indicates a problem where the software attempts to access memory through a null, or non-existent, pointer, which can lead to crashes or potentially allow an attacker to execute arbitrary code.

Recommendations For Samsung Electronics mTower versions 0.3.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2022-36622

Affected Products

Mtower

References · 7

• https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/lib/libutee/tee_api_objects.c#L84 · Patch
• https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/tee/tee_svc.c#L965 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36622 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36622 · Vendor Advisory
• https://github.com/Samsung/mTower · Note
• https://security.samsungmobile.com/securityUpdate.smsb · Note
• https://t.me/cibsecurity/49205 · Telegram Post