CVE-2022-39830

Vulnerability

In sign_pFwInfo in tools/fwinfogen.c of Samsung mTower through version 0.3.0, the return value of EC_KEY_set_public_key_affine_coordinates() is not checked. This function returns 1 on success or 0 on error; when it fails (e.g., due to invalid curve coordinates), the subsequent code continues using an invalid state, leading to a denial-of-service condition [1][2].

Exploitation

An attacker can trigger the vulnerability by supplying malformed elliptic-curve coordinates to sign_pFwInfo. No authentication is required if the attacker can control the input to the firmware signing process; the failure occurs during the signature generation step [1][2].

Impact

Successful exploitation causes a denial of service, preventing legitimate firmware signing operations. The system may crash or hang, disrupting the firmware update process [1][2].

Mitigation

As of publication, no official patch has been released for CVE-2022-39830. Users are advised to manually validate the return value of EC_KEY_set_public_key_affine_coordinates() as outlined in the OpenSSL documentation [2].