CVE-2022-47549

Published: Dec 19, 2022Modified: Jun 17, 2026

6.4

Vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.5 / Impact: 5.9

Source: NVD

Description

An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections.

Affected (1)

Products: Trustedfirmware: Op Tee

Trustedfirmware

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Trustedfirmware Op Tee	Before 3.20

Related CWEs

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (4)

https://github.com/OP-TEE/optee_os/security/advisories/GHSA-r64m-h886-hw6g

Source: cve@mitre.org

Third Party Advisory

https://people.linaro.org/~joakim.bech/reports/Breaking_cross-world_isolation_on_ARM_TrustZone_through_EM_faults_coredumps_and_UUID_confusion.pdf

Source: cve@mitre.org

ExploitTechnical DescriptionVendor Advisory

https://github.com/OP-TEE/optee_os/security/advisories/GHSA-r64m-h886-hw6g

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://people.linaro.org/~joakim.bech/reports/Breaking_cross-world_isolation_on_ARM_TrustZone_through_EM_faults_coredumps_and_UUID_confusion.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitTechnical DescriptionVendor Advisory

Timeline

No history available yet.