Excessive Memory Allocation in Samsung mTower Affected by TEE_Malloc
CVE-2022-38155

7.5HIGH

Key Information:

Vendor
Samsung
Status
Mtower
Vendor
CVE Published:
11 August 2022

Summary

The TEE_Malloc function in Samsung's mTower version 0.3.0 is vulnerable to excessive memory allocation caused by a large length parameter value. This flaw can lead to unintended consequences, including system instability, as evidenced by a crash of the Numaker-PFM-M2351 TEE kernel when invoked. Developers and security professionals should be aware of this vulnerability to implement appropriate protections.

References

https://github.com/Samsung/mTower/blob/18f4b592a8a973ce59...
x_refsource_MISC
https://github.com/Samsung/mTower/issues/74
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.