CVE-2022-26942

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.
References
Link Resource
https://tetraburst.com/ Technical Description
https://tetraburst.com/ Technical Description
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:motorola:mtm5500_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:motorola:mtm5500:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:motorola:mtm5400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:motorola:mtm5400:-:*:*:*:*:*:*:*

History

21 Nov 2024, 06:54

Type Values Removed Values Added
References () https://tetraburst.com/ - Technical Description () https://tetraburst.com/ - Technical Description

Information

Published : 2023-10-19 10:15

Updated : 2024-11-21 06:54


NVD link : CVE-2022-26942

Mitre link : CVE-2022-26942

CVE.ORG link : CVE-2022-26942


JSON object : View

Products Affected

motorola

  • mtm5400
  • mtm5500_firmware
  • mtm5400_firmware
  • mtm5500
CWE
CWE-822

Untrusted Pointer Dereference

CWE-763

Release of Invalid Pointer or Reference