NULL Pointer Dereference in Samsung mTower Affecting Cryptographic Operations
CVE-2022-39829

7.5HIGH

Key Information:

Vendor: Samsung
Status: Mtower
Vendor: CVE Published:; 5 September 2022

What is CVE-2022-39829?

A vulnerability in Samsung mTower, specifically in the aes256_encrypt function, arises from a NULL pointer dereference related to a missing validation of the return value from EVP_CIPHER_CTX_new. This issue affects versions of mTower up to 0.3.0 and can potentially lead to unexpected behavior during cryptographic operations. Developers should ensure that checks for the return value are properly implemented to mitigate this risk.