CVE-2022-27813

Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the firmwares, an adversary with control over either core can trivially gain code execution on the other, by overwriting code located in shared RAM or DDR2 memory regions.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://tetraburst.com/	Technical Description

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:motorola:mtm5500_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:motorola:mtm5500:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:motorola:mtm5400_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:motorola:mtm5400:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-10-19 10:15

Updated : 2023-11-07 03:45

NVD link : CVE-2022-27813

Mitre link : CVE-2022-27813

CVE.ORG link : CVE-2022-27813

JSON object : View

Products Affected

motorola

mtm5500_firmware
mtm5400
mtm5500
mtm5400_firmware

CWE

NVD-CWE-noinfo CWE-1260

Improper Handling of Overlap Between Protected Memory Ranges

{"id": "CVE-2022-27813", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}, {"type": "Secondary", "source": "cert@ncsc.nl", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 6.0, "exploitabilityScore": 1.5}]}, "published": "2023-10-19T10:15:10.013", "references": [{"url": "https://tetraburst.com/", "tags": ["Technical Description"], "source": "cert@ncsc.nl"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "cert@ncsc.nl", "description": [{"lang": "en", "value": "CWE-1260"}]}], "descriptions": [{"lang": "en", "value": "Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the firmwares, an adversary with control over either core can trivially gain code execution on the other, by overwriting code located in shared RAM or DDR2 memory regions."}, {"lang": "es", "value": "Los firmwares de la serie Motorola MTM5000 carecen de protecci\u00f3n de memoria configurada correctamente para las p\u00e1ginas compartidas entre los n\u00facleos OMAP-L138 ARM y DSP. El SoC proporciona dos unidades de protecci\u00f3n de memoria, MPU1 y MPU2, para reforzar el l\u00edmite de confianza entre los dos n\u00facleos. Dado que los firmwares dejan ambas unidades sin configurar, un adversario con control sobre cualquiera de los n\u00facleos puede obtener trivialmente la ejecuci\u00f3n de c\u00f3digo en el otro, sobrescribiendo el c\u00f3digo ubicado en la RAM compartida o en las regiones de memoria DDR2."}], "lastModified": "2023-11-07T03:45:29.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:motorola:mtm5500_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB7C0C44-3660-4B47-A1ED-0BD19EFC5F03"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:motorola:mtm5500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A1A0784B-AE84-4457-A884-5C26EEA8D181"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:motorola:mtm5400_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF669A29-B983-40F6-BBA9-D9F67E653BEF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:motorola:mtm5400:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "03AA5A43-A1B5-4E1C-A844-691607765E30"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cert@ncsc.nl"}