NULL Pointer Dereference in Samsung mTower

Executive Summary

This is a NULL pointer dereference vulnerability in Samsung's Open Source mTower. It allows an attacker to manipulate pointers to cause a denial-of-service (DoS) in the secure world of the mTower system. The issue occurs when a non-secure caller sends a malformed request with an invalid session ID, leading to a crash in the secure world.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for crashes or DoS events in the secure world of mTower, particularly when invalid session IDs are used. Monitor logs for TEE_IOC_INVOKE requests with zero or stale session IDs that may cause NULL pointer dereferences. No specific commands are provided in the context, but examining kernel logs for mTower-related faults or crashes during ioctl operations could indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial-of-service (DoS) in the secure world of the mTower system. This may lead to system crashes, loss of functionality, or disruption of services that rely on the secure world for critical operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a denial-of-service (DoS) in the secure world of the mTower system by crashing it through a NULL pointer dereference. While it does not directly expose data, a DoS could disrupt critical operations, potentially violating availability requirements in standards like GDPR (Article 32) or HIPAA (Security Rule §164.312(a)(2)(ii)). However, the lack of data disclosure or privilege escalation limits broader compliance impacts.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from the Samsung mTower repository (commit afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a) which adds validation checks for NULL session pointers in tee_ioctl_invoke() and tee_ta_invoke_command(). Ensure the fix is deployed on all affected ARM-based targets using QEMU or similar environments. Test the changes with negative test cases involving bogus session IDs to verify the vulnerability is resolved.

Useful 0 Not Useful 0