PT-2023-12786 · Texas Instruments · Texas Instruments Omap L138

Midnight Blue · Publicado 2023-10-19 · Atualizado 2023-10-31 · CVE-2022-25333

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Texas Instruments OMAP L138 (secure variants) (affected versions not specified)

Description The trusted execution environment (TEE) of the Texas Instruments OMAP L138 (secure variants) has a security issue. When loading a module through the SK LOAD routine, it performs an RSA check, but only validates the module header authenticity. This allows an adversary to reuse a correctly signed header and append a forged payload. The payload can be encrypted using the CEK to achieve arbitrary code execution in a secure context, breaking the TEE security architecture.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2022-25333

Produtos afetados

Texas Instruments Omap L138

Referências · 8

• https://twitter.com/DMFezzaReedCISA/status/1714979276200501635 · Publicação no Twitter
• https://t.me/cibsecurity/72554 · Publicação no Telegram
• https://t.me/cvenotify/59706 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1714942800788443198 · Publicação no Twitter
• https://t.me/cvenotify/60247 · Publicação no Telegram
• https://t.me/cvenotify/59720 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-25333 · Nota de Segurança
• https://tetraburst.com · Nota