CVE-2022-40759

A NULL pointer dereference issue in the TEE_MACCompareFinal function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_MACCompareFinal with a NULL pointer for the parameter operation.

• CWE-476

• https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/tee/lib/libutee/tee_api_operations.c#L1249Patch, Third Party Advisory
• https://github.com/Samsung/mTower/issues/80Third Party Advisory
• https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/tee/lib/libutee/tee_api_operations.c#L1249Patch, Third Party Advisory
• https://github.com/Samsung/mTower/issues/80Third Party Advisory

Published

Sep 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40753 IBM InfoSphere Information Server 11.7 is vulnerable to cro…5.4
• CVE-2022-40754In Apache Airflow 2.3.0 through 2.3.4, there was an open red…6.1
• CVE-2022-40755JasPer 3.0.6 allows denial of service via a reachable assert…5.5
• CVE-2022-40756If folder security is misconfigured for Actian Zen PSQL BEFO…8.8
• CVE-2022-40757A Buffer Access with Incorrect Length Value vulnerablity in …7.5
• CVE-2022-40758A Buffer Access with Incorrect Length Value vulnerablity in …7.5
• CVE-2022-4076Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-40760A Buffer Access with Incorrect Length Value vulnerablity in …7.5
• CVE-2022-40761The function tee_obj_free in Samsung mTower through 0.3.0 al…7.5
• CVE-2022-40762A Memory Allocation with Excessive Size Value vulnerablity i…7.5
• CVE-2022-40764Snyk CLI before 1.996.0 allows arbitrary command execution, …7.8
• CVE-2022-40765A vulnerability in the Edge Gateway component of Mitel MiVoi…6.8