CVE-2022-26942 (GCVE-0-2022-26942)

Vulnerability from cvelistv5 – Published: 2023-10-19 09:35 – Updated: 2024-08-03 05:18
VLAI?
Summary
The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.
Severity ?
8.2 (High)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:X/IR:X/AR:X/MAV:L/MAC:L/MPR:H/MUI:N/MS:C/MC:H/MI:H/MA:H
CWE
  • CWE-822 - Untrusted Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Motorola Mobile Radio Affected: MTM5000
Create a notification for this product.
Credits
Midnight Blue
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:h:motorola:mtm5000_series_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mtm5000_series_firmware",
            "vendor": "motorola",
            "versions": [
              {
                "status": "affected",
                "version": "0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-26942",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-15T16:23:58.876138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-15T16:25:32.089Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:18:38.371Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "TETRA:BURST",
            "tags": [
              "related",
              "x_transferred"
            ],
            "url": "https://tetraburst.com/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Mobile Radio",
          "vendor": "Motorola",
          "versions": [
            {
              "status": "affected",
              "version": "MTM5000"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Midnight Blue"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives. "
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:X/IR:X/AR:X/MAV:L/MAC:L/MPR:H/MUI:N/MS:C/MC:H/MI:H/MA:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-822",
              "description": "Untrusted Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-15T00:27:54.327174Z",
        "orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39",
        "shortName": "NCSC-NL"
      },
      "references": [
        {
          "name": "TETRA:BURST",
          "tags": [
            "related"
          ],
          "url": "https://tetraburst.com/"
        }
      ],
      "title": "Multiple missing pointer validation checks in trusted execution module in Motorola MTM5000"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39",
    "assignerShortName": "NCSC-NL",
    "cveId": "CVE-2022-26942",
    "datePublished": "2023-10-19T09:35:24.386Z",
    "dateReserved": "2022-03-11T22:19:24.848Z",
    "dateUpdated": "2024-08-03T05:18:38.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:motorola:mtm5500_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BB7C0C44-3660-4B47-A1ED-0BD19EFC5F03\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:motorola:mtm5500:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A1A0784B-AE84-4457-A884-5C26EEA8D181\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:motorola:mtm5400_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF669A29-B983-40F6-BBA9-D9F67E653BEF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:motorola:mtm5400:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"03AA5A43-A1B5-4E1C-A844-691607765E30\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives. \"}, {\"lang\": \"es\", \"value\": \"Los firmwares de la serie Motorola MTM5000 carecen de validaci\\u00f3n de puntero en los argumentos pasados a los m\\u00f3dulos Trusted Execution Environment (TEE). Se utilizan dos m\\u00f3dulos, uno responsable de la gesti\\u00f3n de claves KVL y el otro de la funcionalidad criptogr\\u00e1fica TETRA. En ambos m\\u00f3dulos, un adversario con una ejecuci\\u00f3n de c\\u00f3digo de nivel de supervisor no segura puede aprovechar el problema para obtener una ejecuci\\u00f3n segura de c\\u00f3digo de supervisor dentro del TEE. Esto constituye una ruptura total del m\\u00f3dulo TEE, exponiendo la clave del dispositivo, as\\u00ed como cualquier clave criptogr\\u00e1fica TETRA y las primitivas criptogr\\u00e1ficas TETRA confidenciales.\"}]",
      "id": "CVE-2022-26942",
      "lastModified": "2024-11-21T06:54:50.667",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"cert@ncsc.nl\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.5, \"impactScore\": 6.0}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.5, \"impactScore\": 6.0}]}",
      "published": "2023-10-19T10:15:09.913",
      "references": "[{\"url\": \"https://tetraburst.com/\", \"source\": \"cert@ncsc.nl\", \"tags\": [\"Technical Description\"]}, {\"url\": \"https://tetraburst.com/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Technical Description\"]}]",
      "sourceIdentifier": "cert@ncsc.nl",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cert@ncsc.nl\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-822\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-763\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-26942\",\"sourceIdentifier\":\"cert@ncsc.nl\",\"published\":\"2023-10-19T10:15:09.913\",\"lastModified\":\"2024-11-21T06:54:50.667\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives. \"},{\"lang\":\"es\",\"value\":\"Los firmwares de la serie Motorola MTM5000 carecen de validaci\u00f3n de puntero en los argumentos pasados a los m\u00f3dulos Trusted Execution Environment (TEE). Se utilizan dos m\u00f3dulos, uno responsable de la gesti\u00f3n de claves KVL y el otro de la funcionalidad criptogr\u00e1fica TETRA. En ambos m\u00f3dulos, un adversario con una ejecuci\u00f3n de c\u00f3digo de nivel de supervisor no segura puede aprovechar el problema para obtener una ejecuci\u00f3n segura de c\u00f3digo de supervisor dentro del TEE. Esto constituye una ruptura total del m\u00f3dulo TEE, exponiendo la clave del dispositivo, as\u00ed como cualquier clave criptogr\u00e1fica TETRA y las primitivas criptogr\u00e1ficas TETRA confidenciales.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cert@ncsc.nl\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.5,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.5,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"cert@ncsc.nl\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-822\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-763\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:motorola:mtm5500_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB7C0C44-3660-4B47-A1ED-0BD19EFC5F03\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:motorola:mtm5500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1A0784B-AE84-4457-A884-5C26EEA8D181\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:motorola:mtm5400_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF669A29-B983-40F6-BBA9-D9F67E653BEF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:motorola:mtm5400:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"03AA5A43-A1B5-4E1C-A844-691607765E30\"}]}]}],\"references\":[{\"url\":\"https://tetraburst.com/\",\"source\":\"cert@ncsc.nl\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://tetraburst.com/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Technical Description\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://tetraburst.com/\", \"name\": \"TETRA:BURST\", \"tags\": [\"related\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T05:18:38.371Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-26942\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-15T16:23:58.876138Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:h:motorola:mtm5000_series_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"motorola\", \"product\": \"mtm5000_series_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-15T16:25:21.416Z\"}}], \"cna\": {\"title\": \"Multiple missing pointer validation checks in trusted execution module in Motorola MTM5000\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Midnight Blue\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:X/IR:X/AR:X/MAV:L/MAC:L/MPR:H/MUI:N/MS:C/MC:H/MI:H/MA:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Motorola\", \"product\": \"Mobile Radio\", \"versions\": [{\"status\": \"affected\", \"version\": \"MTM5000\"}]}], \"references\": [{\"url\": \"https://tetraburst.com/\", \"name\": \"TETRA:BURST\", \"tags\": [\"related\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives. \"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-822\", \"description\": \"Untrusted Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39\", \"shortName\": \"NCSC-NL\", \"dateUpdated\": \"2024-07-15T00:27:54.327174Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-26942\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-03T05:18:38.371Z\", \"dateReserved\": \"2022-03-11T22:19:24.848Z\", \"assignerOrgId\": \"cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39\", \"datePublished\": \"2023-10-19T09:35:24.386Z\", \"assignerShortName\": \"NCSC-NL\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.