CVE-2022-28793 MEDIUM

CVE-2022-28793

Vendor Samsung Mobile
Product Samsung Mobile Devices
Weakness CWE-754
Published May 3, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

4.4/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot cycle after compromising TEE. The patch is applied in Galaxy S22 to prevent change of Android ROT after first initialization at boot time.

Key dates

02Disclosure timeline

May 3, 2022 CVE published
August 3, 2024 Record updated