CVE-2022-25333 - OpenCVE

The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Ti	Omap L138 Firmware Omap L138

Configuration 1 [-]

AND

cpe:2.3:o:ti:omap_l138_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ti:omap_l138:-:*:*:*:*:*:*:*

References

Link	Resource
https://tetraburst.com/	Not Applicable

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: NCSC-NL

Published: 2023-10-19T09:35:03.919Z

Updated: 2023-10-19T09:50:11.988Z

Reserved: 2022-02-18T17:18:33.456Z

Link: CVE-2022-25333

JSON object: View

NVD Information

Status : Modified

Published: 2023-10-19T10:15:09.747

Modified: 2023-11-07T03:44:46.143

Link: CVE-2022-25333

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ti:omap_l138_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "E099834F-A5EF-4E60-A351-43FEF06E3C07", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ti:omap_l138:-:*:*:*:*:*:*:*", "matchCriteriaId": "3D453CDD-014F-47EC-B6FD-9CE790450230", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture."}, {"lang": "es", "value": "Texas Instruments OMAP L138 (variantes seguras) Trusted Execution Environment (TEE) realiza una verificaci\u00f3n RSA implementada en la m\u00e1scara ROM al cargar un m\u00f3dulo a trav\u00e9s de la rutina SK_LOAD. Sin embargo, s\u00f3lo se valida la autenticidad del encabezado del m\u00f3dulo. Un adversario puede reutilizar cualquier encabezado firmado correctamente y agregar un payload falsificado, que se cifrar\u00e1 mediante CEK (que se puede obtener a trav\u00e9s de CVE-2022-25332) para obtener la ejecuci\u00f3n de c\u00f3digo arbitrario en un contexto seguro. Esto constituye una ruptura total de la arquitectura de seguridad de TEE."}], "id": "CVE-2022-25333", "lastModified": "2023-11-07T03:44:46.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "cert@ncsc.nl", "type": "Secondary"}]}, "published": "2023-10-19T10:15:09.747", "references": [{"source": "cert@ncsc.nl", "tags": ["Not Applicable"], "url": "https://tetraburst.com/"}], "sourceIdentifier": "cert@ncsc.nl", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-347"}], "source": "cert@ncsc.nl", "type": "Secondary"}]}