Pointer Manipulation in Samsung mTower

Executive Summary

This vulnerability is an untrusted pointer dereference flaw in Samsung's Open Source mTower, specifically in the TrustZone-M implementation. Non-secure (NS) callers can manipulate secure-world memory by providing unchecked pointers to the `cmse_nonsecure_entry` ioctl() handler. The handler dereferences these pointers without validating they point to non-secure memory, allowing malicious NS code to redirect secure memory operations into secure RAM, bypassing TrustZone isolation.

Useful 0 Not Useful 0

Detection Guidance

Detection requires checking if your mTower version is affected. Verify the installed version against the vulnerable commit range before 06994e303637512e39062f3e037c222e8448e57e. Use commands like git log or version checks in mTower to confirm the build. No direct network detection commands are provided.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker with access to non-secure code to manipulate secure memory operations, potentially leading to unauthorized access or modification of sensitive data in secure memory. This could compromise the integrity and confidentiality of secure applications running on the device.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows non-secure code to manipulate secure memory, potentially bypassing isolation mechanisms. This could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements for data protection standards like GDPR or HIPAA that mandate strict access controls and data integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Update mTower to the patched commit 06994e303637512e39062f3e037c222e8448e57e or later. Apply the changes from the referenced pull request which adds pointer validation in entry_std.c and fixes error propagation in TEEC_OpenSession. Ensure ARM-specific configurations are tested.

Useful 0 Not Useful 0