CVE-2022-25332: texas instruments omap Observable Timing Discrepancy

Vulnerability summary

CVE-2022-25332 is a medium (CVSS 4.4) Observable Timing Discrepancy vulnerability in texas instruments omap. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 0.9% of scored vulnerabilities.

Timeline

1. 19-10-2023
   PublishedVulnerability first disclosed.
2. 27-02-2025
   Last modifiedVulnerability information updated.

Description

The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext inputs. Using this side channel, the SK_LOAD secure kernel routine can be used to recover the Customer Encryption Key (CEK).

• CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.