CVE-2023-52457

CVE-2023-52457 relates to the Linux kernel serial8250/omap path. The issue occurred when remove() returned an error, causing the driver core to log a non-zero removal error and potentially leaking resources if serial8250_unregister_port() was skipped, leaving UART resources around and enabling a ...

CVE-2023-52457

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: omap: Don't skip resource freeing if pmruntimeresumeandget failed Returning an error code from .remove makes the driver core emit the little helpful error message: remove callback returned a non-zero value. This wil...

CVE-2022-25333

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE performs an RSA check implemented in mask ROM when loading a module through the SKLOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and appe...

CVE-2022-25334

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE lacks a bounds check on the signature size field in the SKLOAD module loading routine, present in mask ROM. A module with a sufficiently large signature field causes a stack overflow, affecting secure kernel data...

CVE-2022-25332

The AES implementation in the Texas Instruments OMAP L138 secure variants, present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext...

CVE-2022-25334

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE lacks a bounds check on the signature size field in the SKLOAD module loading routine, present in mask ROM. A module with a sufficiently large signature field causes a stack overflow, affecting secure kernel data...

CVE-2022-25333

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE performs an RSA check implemented in mask ROM when loading a module through the SKLOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and appe...

Code injection

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE performs an RSA check implemented in mask ROM when loading a module through the SKLOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and appe...

Design/Logic Flaw

The AES implementation in the Texas Instruments OMAP L138 secure variants, present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext...

Stack overflow

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE lacks a bounds check on the signature size field in the SKLOAD module loading routine, present in mask ROM. A module with a sufficiently large signature field causes a stack overflow, affecting secure kernel data...

CVE-2022-25332 SK_LOAD timing side channel during AES module decryption in Texas Instruments OMAP L138

The AES implementation in the Texas Instruments OMAP L138 secure variants, present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext...

CVE-2022-25332

The CVE-2022-25332 entry concerns the Texas Instruments OMAP L138 family (secure variants) TEE in mask ROM. A timing side-channel in the AES implementation can be exploited by an attacker with non-secure supervisor privileges to manipulate cache content and observe timing differences across ciphe...

CVE-2022-25332 SK_LOAD timing side channel during AES module decryption in Texas Instruments OMAP L138

The AES implementation in the Texas Instruments OMAP L138 secure variants, present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext...

CVE-2022-25334 Stack overflow on SK_LOAD signature length field in Texas Instruments OMAP L138

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE lacks a bounds check on the signature size field in the SKLOAD module loading routine, present in mask ROM. A module with a sufficiently large signature field causes a stack overflow, affecting secure kernel data...

CVE-2022-25334

CVE-2022-25334 relates to the Texas Instruments OMAP L138 (secure variants) TEE. The mask ROM SK_LOAD routine has no bounds check on the signature size, so a module with a large signature can overflow the stack and enable arbitrary code execution in the secure supervisor context by overwriting a ...

CVE-2022-25333 Flawed SK_LOAD module authenticity check in Texas Instruments OMAP L138

The Texas Instruments OMAP L138 secure variants trusted execution environment TEE performs an RSA check implemented in mask ROM when loading a module through the SKLOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and appe...

CVE-2022-25333

The CVE-2022-25333 entry concerns the Texas Instruments OMAP L138 secure-variant TEE. The RSA check in the SK_LOAD routine validates only the module header authenticity, allowing an adversary to reuse a signed header with a forged payload decrypted using the CEK, enabling arbitrary code execution...

CVE-2022-27813 Unconfigured memory protection modules in Motorola MTM5000

Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the...

CVE-2022-27813 Unconfigured memory protection modules in Motorola MTM5000

Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the...

Texas Instruments OMAP L138 Security Vulnerability

The Texas Instruments OMAP L138 is a DSP+ARM industrial processor from Texas Instruments. A security vulnerability exists in the Texas Instruments OMAP L138 secure variants, which stems from the fact that when a module is loaded via the SKLOAD routine, the Trusted Execution Environment TEE perfor...