CVE-2022-28793CWE-754

Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot…

Medium · published May 3, 2022

CVSS v3.1
4.4
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot cycle after compromising TEE. The patch is applied in Galaxy S22 to prevent change of Android ROT after first initialization at boot time.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00218 · 11.6th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2022-05-03T19:44Z
EPSS history
Timeline
  • 03 MAY 19:44Z
    Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot…
    cvelistv5