CVE-2022-25333CWE-347

Flawed SK_LOAD module authenticity check in Texas Instruments OMAP L138

High · published October 19, 2023

CVSS v3.1
8.2
EPSS
0%
Percentile
3.0
In the wild
Unconfirmed
What it is

The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:L/MAC:L/MPR:H/MUI:N/MS:C/MC:H/MI:H/MA:H
CVSS v4.0
Not supplied
EPSS
0.00139 · 3.0th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2023-10-19T09:35Z
EPSS history
Timeline
  • 19 OCT 09:35Z
    Flawed SK_LOAD module authenticity check in Texas Instruments OMAP L138
    cvelistv5