PT-2022-15990 · Rpmb · Rpmb

Federico Menarini + 1 · Published 2022-02-11 · Updated 2023-07-12 · CVE-2022-23432

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RPMB ldfw versions prior to SMR Feb-2022 Release 1

Description The issue is related to improper input validation in the SMC SRPMB WSM handler of RPMB ldfw, allowing arbitrary memory write and code execution.

Recommendations For versions prior to SMR Feb-2022 Release 1, update to SMR Feb-2022 Release 1 or later to resolve the issue.

Fix

Memory Corruption

RCE

Weakness Enumeration

CWE-787

CWE-20

Related Identifiers

CVE-2022-23432

Affected Products

Rpmb

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-23432 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23432 · Vendor Advisory
• https://t.me/cibsecurity/37309 · Telegram Post
• https://t.me/cvenotify/27017 · Telegram Post
• https://t.me/cvenotify/54110 · Telegram Post