CVE-2022-27813 - OpenCVE

Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the firmwares, an adversary with control over either core can trivially gain code execution on the other, by overwriting code located in shared RAM or DDR2 memory regions.

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Motorola	Mtm5400 Firmware Mtm5500 Mtm5400 Mtm5500 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:motorola:mtm5500_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:motorola:mtm5500:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:motorola:mtm5400_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:motorola:mtm5400:-:*:*:*:*:*:*:*

References

Link	Resource
https://tetraburst.com/	Technical Description

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: NCSC-NL

Published: 2023-10-19T09:34:44.148Z

Updated: 2023-10-19T09:34:44.148Z

Reserved: 2022-03-24T03:04:57.475Z

Link: CVE-2022-27813

JSON object: View

NVD Information

Status : Modified

Published: 2023-10-19T10:15:10.013

Modified: 2023-11-07T03:45:29.027

Link: CVE-2022-27813

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:motorola:mtm5500_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "BB7C0C44-3660-4B47-A1ED-0BD19EFC5F03", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:motorola:mtm5500:-:*:*:*:*:*:*:*", "matchCriteriaId": "A1A0784B-AE84-4457-A884-5C26EEA8D181", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:motorola:mtm5400_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "FF669A29-B983-40F6-BBA9-D9F67E653BEF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:motorola:mtm5400:-:*:*:*:*:*:*:*", "matchCriteriaId": "03AA5A43-A1B5-4E1C-A844-691607765E30", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the firmwares, an adversary with control over either core can trivially gain code execution on the other, by overwriting code located in shared RAM or DDR2 memory regions."}, {"lang": "es", "value": "Los firmwares de la serie Motorola MTM5000 carecen de protecci\u00f3n de memoria configurada correctamente para las p\u00e1ginas compartidas entre los n\u00facleos OMAP-L138 ARM y DSP. El SoC proporciona dos unidades de protecci\u00f3n de memoria, MPU1 y MPU2, para reforzar el l\u00edmite de confianza entre los dos n\u00facleos. Dado que los firmwares dejan ambas unidades sin configurar, un adversario con control sobre cualquiera de los n\u00facleos puede obtener trivialmente la ejecuci\u00f3n de c\u00f3digo en el otro, sobrescribiendo el c\u00f3digo ubicado en la RAM compartida o en las regiones de memoria DDR2."}], "id": "CVE-2022-27813", "lastModified": "2023-11-07T03:45:29.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "cert@ncsc.nl", "type": "Secondary"}]}, "published": "2023-10-19T10:15:10.013", "references": [{"source": "cert@ncsc.nl", "tags": ["Technical Description"], "url": "https://tetraburst.com/"}], "sourceIdentifier": "cert@ncsc.nl", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-1260"}], "source": "cert@ncsc.nl", "type": "Secondary"}]}