OP-TEE optee_os versions from 4.5.0 up to but not including 4.11.0 contain a vulnerability in the Hisilicon HPRE crypto driver's RSA-OAEP decryption implementation. The vulnerability is due to the use of a non-constant-time memcmp() function for label hash verification and the presence of multiple distinguishable error paths. This creates a Manger-style padding oracle, allowing an attacker with local access to recover RSA-OAEP plaintext by performing approximately 1000-2000 adaptive chosen ciphertext queries. The vulnerability only affects the plat-d06 platform with CFG_HISILICON_ACC_V3 enabled, which is disabled by default. Version 4.11.0 contains a patch that addresses this issue. As a workaround, disabling the Hisilicon HPRE RSA driver by setting CFG_HISILICON_ACC_V3 to n mitigates the vulnerability.

The vulnerability allows an attacker with local access and low privileges to recover RSA-OAEP plaintext by exploiting a timing side-channel in the Hisilicon HPRE crypto driver's RSA-OAEP decryption. The impact is limited to confidentiality (partial plaintext disclosure) with no impact on integrity or availability. The attack requires adaptive chosen ciphertext queries and is constrained to specific hardware and configuration (plat-d06 with CFG_HISILICON_ACC_V3 enabled).

Version 4.11.0 of OP-TEE optee_os contains a patch that fixes this vulnerability. If upgrading is not immediately possible, a workaround is to disable the Hisilicon HPRE RSA driver by setting CFG_HISILICON_ACC_V3 to n, which is disabled by default. No other vendor advisories or official fixes are provided. Patch status is not yet confirmed beyond the stated version 4.11.0 fix; users should verify with the vendor advisory for the latest remediation guidance.