The vulnerability in esp-idf versions 5.5.4 and 6.0 involves improper input validation in ESP-TEE secure-service wrappers within esp_secure_services.c and esp_secure_services_iram.c. These wrappers validate only some caller-supplied pointer arguments, leaving others unchecked. Because the underlying trusted execution environment (TEE) hardware peripherals operate in RISC-V machine mode with full address-space access, an attacker can supply pointers to TEE-exclusive memory. This causes the peripherals to read sensitive TEE memory and return data derived from it to the Rich Execution Environment (REE). Depending on the wrapper, the leaked data can be raw bytes, computed functions of TEE memory, or bits that can be used as an oracle to incrementally disclose sensitive TEE-resident data. This vulnerability has been addressed in esp-idf versions 5.5.5 and 6.0.1.

An attacker with local access can exploit this vulnerability to read sensitive memory contents from the TEE, potentially disclosing confidential data protected by the secure environment. The vulnerability does not impact integrity or availability but results in a confidentiality breach. The CVSS v3.1 score is 7.1 (high), reflecting local attack vector, low complexity, no privileges required, no user interaction, and a confidentiality impact classified as high.

This vulnerability has been fixed in esp-idf versions 5.5.5 and 6.0.1. Users should upgrade to these or later versions to remediate the issue. No other mitigation or temporary workaround is indicated in the available data.