Threat Intelligence Database

OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver that allows a malicious Trusted Application to corrupt secure-world heap memory by supplying an input length exceeding the RSA modulus size. When src_len exceeds rsa_len, the subtraction expression wraps to a large unsigned value, causing a subsequent memcpy to write attacker-controlled data before the destination buffer in S-EL1 secure-world heap memory.

A use-after-free vulnerability exists in OP-TEE OS up to version 4.10.0 in the Trusted Application loader. This flaw allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by exploiting concurrent session handling without proper locking. The issue is triggered by setting the TA_FLAG_CONCURRENT flag in a user TA signed header, leading to memory corruption and use-after-free conditions in secure-world kernel memory.

A null pointer dereference vulnerability exists in OP-TEE OS versions up to 4.10.0 in the Widevine pseudo-TA open_session handler. This flaw allows Normal World clients to cause a denial of service by triggering a crash in the trusted execution environment when the CFG_WIDEVINE_PTA configuration is enabled. The issue is fixed in a commit identified as 0aadfc2.