{"id":"CVE-2022-25333","aliases":["EUVD-2022-30012","GHSA-f4x5-257x-2739"],"status":"published","title":"Flawed SK_LOAD module authenticity check in Texas Instruments OMAP L138","description":"The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:L/MAC:L/MPR:H/MUI:N/MS:C/MC:H/MI:H/MA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00139,"percentile":0.03308,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2023-10-19T09:35:03Z","modified":"2026-06-17T04:33:24Z","products":[{"vendor":"texas instruments","product":"omap"},{"vendor":"ti","product":"omap_l138_firmware"}],"references":[{"url":"https://tetraburst.com/","tags":["related","x_transferred","Not Applicable"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25333"},{"url":"https://tetraburst.com"},{"url":"https://github.com/advisories/GHSA-f4x5-257x-2739"}],"sources":{"cve":[{"id":"CVE-2022-25333","title":"Flawed SK_LOAD module authenticity check in Texas Instruments OMAP L138","description":"The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.","status":"published","published":"2023-10-19T09:35:03.919Z","modified":"2024-08-03T04:36:06.868Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:L/MAC:L/MPR:H/MUI:N/MS:C/MC:H/MI:H/MA:H","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:34:28.707644Z"}],"euvd":[{"id":"EUVD-2022-30012","description":"The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.","status":"published","published":"2023-10-19T09:35:03Z","modified":"2024-08-03T04:36:06Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:L/MAC:L/MPR:H/MUI:N/MS:C/MC:H/MI:H/MA:H","level":"high"}],"updated_at":"2026-11-03T03:25:47.443246Z"}],"ghsa":[{"id":"GHSA-f4x5-257x-2739","title":"The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an...","description":"The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.","status":"published","published":"2023-10-19T12:30:23Z","modified":"2024-04-04T08:47:26Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:57:01.229221Z"}],"nvd":[{"id":"CVE-2022-25333","description":"The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.","status":"published","published":"2023-10-19T10:15:09.747Z","modified":"2026-06-17T04:33:24.82Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:07:39.811118Z"}]}}