The vulnerability exists in OP-TEE's optee_os component, specifically in the emsa_pkcs1_v1_5_encode() function used for RSA signature padding. The calculation of the padding size (PS size) subtracts the digest size and other encoding fields from the RSA modulus size. If the modulus is small enough, this subtraction results in an integer underflow (wraparound), causing the padding size to become a very large number. Consequently, the memset() function writes 0xFF bytes beyond the intended buffer, leading to memory corruption and a crash of the OP-TEE environment. This flaw affects versions from 3.8.0 up to 4.10 and only impacts platforms that enable RSA acceleration. The vulnerability is tracked as CWE-190 (Integer Overflow or Wraparound) and has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The integer overflow causes memory corruption that leads to a denial of service by crashing the OP-TEE trusted execution environment. There is no indication of confidentiality or integrity impact, only availability is affected. This could disrupt secure operations relying on OP-TEE on affected platforms, particularly those using RSA acceleration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding configurations with small RSA modulus sizes that could trigger the overflow or disabling RSA acceleration if feasible. Monitor vendor channels for updates and apply patches once released.