Executive brief
Samsung mTower is a trusted execution environment (TEE) component that provides a secure processing space isolated from the main operating system. An untrusted pointer dereference vulnerability allows a malicious or buggy trusted application to pass specially crafted pointer values to syscall handlers, potentially causing out-of-bounds memory access and compromising the integrity of the secure world. This could enable attackers to bypass security boundaries, leak sensitive data, or escalate privileges within the TEE.
Technical details
The vulnerability exists in mTower's copy helper functions (tee_svc_copy_to_user/tee_svc_copy_from_user) and crypto syscalls (utee_hash_update/final, utee_cipher_init, cipher_update, copy_in_attrs) that dereference or memcpy trusted application (TA)-supplied pointer ranges without proper validation. The root cause is that the tee_mmu_check_access_rights() guard was commented out or missing at multiple call sites. A malicious TA can pass NULL pointers, invalid ranges, or address-space-wrapping ranges to trigger out-of-bounds memory access in the secure kernel. The fix implements proper pointer validation in tee_mmu_check_access_rights() to reject NULL+len and wrapping ranges, then restores the guard at all vulnerable call sites. No per-TA MMU/MPU context means all access checks use TEE_MEMORY_ACCESS_ANY_OWNER, making strict bounds checking essential.
Affected products
- Samsung mTower before 102d3dc75cf8e58e68e4bea54ae3c803992c91be
Timeline
- 2026-09-01: disclosed
- 2026-08-05: patched: Fix merged in PR #252