Description
The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Texas Instruments | OMAP | affected |
|
Configuration 1 [-]
| AND |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-30012 | The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture. |
References
| Link | Providers |
|---|---|
| https://tetraburst.com/ |
|
History
No history.
MITRE
Status: PUBLISHED
Assigner: NCSC-NL
Published:
Updated: 2024-08-03T04:36:06.868Z
Reserved: 2022-02-18T17:18:33.456Z
Link: CVE-2022-25333
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-10-19T10:15:09.747
Modified: 2024-11-21T06:52:01.270
Link: CVE-2022-25333
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses