NULL Pointer Dereference in Samsung mTower Affects Trusted Application Operations
CVE-2022-40759

7.5HIGH

Key Information:

Vendor

Samsung
Status
Mtower
Vendor
CVE Published:
16 September 2022

What is CVE-2022-40759?

A vulnerability in the TEE_MACCompareFinal function of Samsung mTower allows a trusted application to initiate a Denial of Service (DoS) by passing a NULL pointer as an argument. This flaw can lead to unintended behavior and service disruption in applications relying on this function, posing a significant risk to application stability and overall system integrity.

References

https://github.com/Samsung/mTower/blob/efd36709306a9afcca...
x_refsource_MISC
https://github.com/Samsung/mTower/issues/80
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.