CVE-2022-26942 - OpenCVE

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Motorola	Mtm5400 Firmware Mtm5500 Mtm5400 Mtm5500 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:motorola:mtm5500_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:motorola:mtm5500:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:motorola:mtm5400_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:motorola:mtm5400:-:*:*:*:*:*:*:*

References

Link	Resource
https://tetraburst.com/	Technical Description

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: NCSC-NL

Published: 2023-10-19T09:35:24.386Z

Updated: 2023-10-19T09:35:24.386Z

Reserved: 2022-03-11T22:19:24.848Z

Link: CVE-2022-26942

JSON object: View

NVD Information

Status : Modified

Published: 2023-10-19T10:15:09.913

Modified: 2023-11-07T03:45:15.783

Link: CVE-2022-26942

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:motorola:mtm5500_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "BB7C0C44-3660-4B47-A1ED-0BD19EFC5F03", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:motorola:mtm5500:-:*:*:*:*:*:*:*", "matchCriteriaId": "A1A0784B-AE84-4457-A884-5C26EEA8D181", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:motorola:mtm5400_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "FF669A29-B983-40F6-BBA9-D9F67E653BEF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:motorola:mtm5400:-:*:*:*:*:*:*:*", "matchCriteriaId": "03AA5A43-A1B5-4E1C-A844-691607765E30", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives. "}, {"lang": "es", "value": "Los firmwares de la serie Motorola MTM5000 carecen de validaci\u00f3n de puntero en los argumentos pasados a los m\u00f3dulos Trusted Execution Environment (TEE). Se utilizan dos m\u00f3dulos, uno responsable de la gesti\u00f3n de claves KVL y el otro de la funcionalidad criptogr\u00e1fica TETRA. En ambos m\u00f3dulos, un adversario con una ejecuci\u00f3n de c\u00f3digo de nivel de supervisor no segura puede aprovechar el problema para obtener una ejecuci\u00f3n segura de c\u00f3digo de supervisor dentro del TEE. Esto constituye una ruptura total del m\u00f3dulo TEE, exponiendo la clave del dispositivo, as\u00ed como cualquier clave criptogr\u00e1fica TETRA y las primitivas criptogr\u00e1ficas TETRA confidenciales."}], "id": "CVE-2022-26942", "lastModified": "2023-11-07T03:45:15.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "cert@ncsc.nl", "type": "Secondary"}]}, "published": "2023-10-19T10:15:09.913", "references": [{"source": "cert@ncsc.nl", "tags": ["Technical Description"], "url": "https://tetraburst.com/"}], "sourceIdentifier": "cert@ncsc.nl", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-763"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-822"}], "source": "cert@ncsc.nl", "type": "Secondary"}]}