CVE-2022-25333

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE performs an RSA check implemented in mask ROM when loading a module through the SKLOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and appe...

CVE-2022-25332

The AES implementation in the Texas Instruments OMAP L138 secure variants, present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext...

Stack overflow

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE lacks a bounds check on the signature size field in the SKLOAD module loading routine, present in mask ROM. A module with a sufficiently large signature field causes a stack overflow, affecting secure kernel data...

Design/Logic Flaw

The AES implementation in the Texas Instruments OMAP L138 secure variants, present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext...

Code injection

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE performs an RSA check implemented in mask ROM when loading a module through the SKLOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and appe...

CVE-2022-25332 SK_LOAD timing side channel during AES module decryption in Texas Instruments OMAP L138

The AES implementation in the Texas Instruments OMAP L138 secure variants, present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext...

CVE-2022-25332 SK_LOAD timing side channel during AES module decryption in Texas Instruments OMAP L138

The AES implementation in the Texas Instruments OMAP L138 secure variants, present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext...

CVE-2022-25332

The CVE-2022-25332 entry concerns the Texas Instruments OMAP L138 family (secure variants) TEE in mask ROM. A timing side-channel in the AES implementation can be exploited by an attacker with non-secure supervisor privileges to manipulate cache content and observe timing differences across ciphe...

CVE-2022-25334

CVE-2022-25334 relates to the Texas Instruments OMAP L138 (secure variants) TEE. The mask ROM SK_LOAD routine has no bounds check on the signature size, so a module with a large signature can overflow the stack and enable arbitrary code execution in the secure supervisor context by overwriting a ...

CVE-2022-25334 Stack overflow on SK_LOAD signature length field in Texas Instruments OMAP L138

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE lacks a bounds check on the signature size field in the SKLOAD module loading routine, present in mask ROM. A module with a sufficiently large signature field causes a stack overflow, affecting secure kernel data...

CVE-2022-25333

The CVE-2022-25333 entry concerns the Texas Instruments OMAP L138 secure-variant TEE. The RSA check in the SK_LOAD routine validates only the module header authenticity, allowing an adversary to reuse a signed header with a forged payload decrypted using the CEK, enabling arbitrary code execution...

CVE-2022-25333 Flawed SK_LOAD module authenticity check in Texas Instruments OMAP L138

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE performs an RSA check implemented in mask ROM when loading a module through the SKLOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and appe...

Texas Instruments OMAP L138 Security Vulnerability

The Texas Instruments OMAP L138 is a DSP+ARM industrial processor from Texas Instruments. A security vulnerability exists in the Texas Instruments OMAP L138 secure variants, which stems from the ES implementation being susceptible to a timing side-channel, which can be exploited by an attacker to...

PT-2023-12786 · Texas Instruments · Texas Instruments Omap L138

Name of the Vulnerable Software and Affected Versions: Texas Instruments OMAP L138 secure variants affected versions not specified Description: The trusted execution environment TEE of the Texas Instruments OMAP L138 secure variants has a security issue. When loading a module through the SK LOAD...

PT-2023-12787 · Texas Instruments · Texas Instruments Omap L138

Name of the Vulnerable Software and Affected Versions: Texas Instruments OMAP L138 secure variants affected versions not specified Description: The trusted execution environment TEE lacks a bounds check on the signature size field in the SK LOAD module loading routine, present in mask ROM. A modu...

CVE-2023-29468

The Texas Instruments TI WiLink WL18xx MCP driver does not limit the number of information elements IEs of type XCCEXT1IEID or XCCEXT2IEID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code...

CVE-2023-29468

The Texas Instruments TI WiLink WL18xx MCP driver does not limit the number of information elements IEs of type XCCEXT1IEID or XCCEXT2IEID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code...

Buffer overflow

The Texas Instruments TI WiLink WL18xx MCP driver does not limit the number of information elements IEs of type XCCEXT1IEID or XCCEXT2IEID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code...

CVE-2023-29468

The Texas Instruments TI WiLink WL18xx MCP driver does not limit the number of information elements IEs of type XCCEXT1IEID or XCCEXT2IEID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code...

CVE-2023-29468

The Texas Instruments TI WiLink WL18xx MCP driver does not limit the number of information elements IEs of type XCCEXT1IEID or XCCEXT2IEID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code...