Executive brief
Samsung mTower is a Trusted Execution Environment (TEE) implementation that provides a secure isolated execution environment for critical operations on Samsung devices. An attacker with access to the non-secure world can manipulate pointers passed to the secure world, potentially bypassing security isolation and gaining unauthorized access to sensitive data or disrupting TEE operations.
Technical details
This is an untrusted pointer dereference vulnerability in the secure-world boundary validation logic of Samsung mTower. The vulnerability occurs when the TEE fails to properly validate non-secure pointers passed from the normal world (non-secure context) before dereferencing them in the secure world. An attacker in the non-secure world can craft malicious pointer values to manipulate secure-world memory access, potentially reading/writing sensitive data or breaking TrustZone-M isolation guarantees. The fix was implemented in pull request #250 to add proper non-secure pointer validation at the secure-world boundary. This is a critical trust boundary violation affecting the core isolation mechanism of the TEE.
Affected products
- Samsung mTower before 06994e303637512e39062f3e037c222e8448e57e
Timeline
- 2026-09-01: disclosed
- 2026-07-28: patched: Fix merged in PR #250