PT-2022-25522 · Samsung · Samsung Mtower

Published 2022-09-16 · Updated 2023-08-08 · CVE-2022-40761

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Samsung mTower versions 0.3.0 and earlier

Description The issue allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE AllocateOperation with a disturbed heap layout, related to utee cryp obj alloc. This is due to the tee obj free function in Samsung mTower.

Recommendations For Samsung mTower versions 0.3.0 and earlier, consider disabling the TEE AllocateOperation function as a temporary workaround until a patch is available. Restrict access to the utee cryp obj alloc related functionality to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2022-40761

Affected Products

Samsung Mtower

References · 6

• https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/tee/tee/tee_obj.c#L109 · Patch
• https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/tee/tee/tee_svc_cryp.c#L1248 · Patch
• https://osv.dev/vulnerability/CVE-2022-40761 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40761 · Security Note
• https://github.com/Samsung/mTower/issues/83 · Note
• https://t.me/cibsecurity/50006 · Telegram Post