HOMEVULNERABILITIESCVE-2022-25332
MEDIUM

CVE-2022-25332

CWE-208Published: October 19, 2023· Updated: Jun 17, 2026

4.1
CVSS v3.1

Official Description

The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext inputs. Using this side channel, the SK_LOAD secure kernel routine can be used to recover the Customer Encryption Key (CEK).

NVD Source

Technical Analysis

CVE-2022-25332 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 4.1.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityHigh
Privileges Req.High
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected Vendors & Products

ti2 product(s)
omap l138 firmwareomap l138
Source: NVD CPE · 2 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
External links open in a new tab. Always verify in a controlled environment before use.

All References (2)

https://tetraburst.com/Technical Description
https://tetraburst.com/Technical Description

Quick Facts

CVE IDCVE-2022-25332
CVSS Score4.1 / 10
SeverityMEDIUM
WeaknessCWE-208
CISA KEVNo
Affected1 vendor(s)
PublishedOct 19, 2023

Related CVEs (CWE-208)

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2022-25332 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWatch. CVE data is provided under the NVD usage policy.