OP-TEE's optee_os versions starting from 3.3.0 up to before 4.11.0 contain a resource leak in the shared memory cleanup logic. The function cleanup_shm_refs() fails to apply the required bitmask OPTEE_MSG_ATTR_TYPE_MASK to parameter attributes. This causes the system to skip the necessary mobj_put() call when processing non-contiguous memory parameters from a normal-world caller, resulting in persistent reference leaks of mobj_reg_shm objects. These leaked objects accumulate on internal lists with dangling reference counts, progressively consuming secure-world heap memory and degrading the system's ability to service trusted application operations. The issue affects non-FF-A configurations supporting non-contiguous, non-secure shared memory. The vulnerability is patched in version 4.11.0. No workarounds are known.

The vulnerability causes a resource leak that progressively consumes secure-world heap memory, leading to degraded performance and eventual inability to service trusted application operations. This condition ultimately requires a system reboot to recover. There is no impact on confidentiality or integrity, only availability is affected. No known exploits exist in the wild.

Version 4.11.0 of optee_os contains a patch that fixes this resource leak vulnerability. Users should upgrade to version 4.11.0 or later to remediate the issue. No workarounds are available. Patch status is not explicitly confirmed beyond the mention of the fix in 4.11.0; verify with the vendor advisory for current remediation guidance.