A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_MACUpdate with an excessive size value of chunkSize.
References
| Link | Resource |
|---|---|
| https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/crypto/libtomcrypt/include/tomcrypt_hash.h#L397 | Patch Third Party Advisory |
| https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/tee/lib/libutee/tee_api_operations.c#L1188 | Patch Third Party Advisory |
| https://github.com/Samsung/mTower/issues/81 | Third Party Advisory |
| https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/crypto/libtomcrypt/include/tomcrypt_hash.h#L397 | Patch Third Party Advisory |
| https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/tee/lib/libutee/tee_api_operations.c#L1188 | Patch Third Party Advisory |
| https://github.com/Samsung/mTower/issues/81 | Third Party Advisory |
Configurations
History
21 Nov 2024, 07:22
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/crypto/libtomcrypt/include/tomcrypt_hash.h#L397 - Patch, Third Party Advisory | |
| References | () https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/tee/lib/libutee/tee_api_operations.c#L1188 - Patch, Third Party Advisory | |
| References | () https://github.com/Samsung/mTower/issues/81 - Third Party Advisory |
Information
Published : 2022-09-16 22:15
Updated : 2024-11-21 07:22
NVD link : CVE-2022-40760
Mitre link : CVE-2022-40760
CVE.ORG link : CVE-2022-40760
JSON object : View
Products Affected
samsung
- mtower
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer