Weak PRNG entropy source used for authentication challenge generation in Motorola MTM5000

The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challenge vulnerable to two attacks. First, due to the limited boottime pool entropy, an adversary can derive the contents of the entropy pool by an exhaustive search of possible values, based on an observed authentication challenge. Second, an adversary can use knowledge of the entropy pool to predict authentication challenges. As such, the unit is vulnerable to CVE-2022-24400.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

使用具有密码学弱点缺陷的PRNG

Motorola MTM5000 安全特征问题漏洞

Motorola MTM5000是美国摩托罗拉（Motorola）公司的一种移动收音机。 Motorola MTM5000 存在安全漏洞，该漏洞源于使用 PRNG 生成 TETRA 身份验证质询，并使用滴答计数寄存器作为其唯一的熵源，攻击者利用该漏洞可以根据观察到的身份验证质询，通过对可能值的详尽搜索来推导出熵池的内容。

N/A

N/A