Description

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA open_session handler that allows Normal World clients to cause a denial of service when CFG_WIDEVINE_PTA is enabled. Attackers can open a session directly on the Widevine PTA to trigger an unconditional dereference of a NULL calling session pointer via is_user_ta_ctx(), faulting the TEE at S-EL1 and crashing the trusted execution environment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-10T19:17:32.103Z",
  "pubdate": "2026-08-10T19:17:32.103Z",
  "executiveSummary": "OP-TEE OS through 4.10.0 contains a null pointer dereference vulnerability residing in the Widevine pseudo-TA open_session handler.\nThe vulnerability allows Normal World clients to cause a denial of service (DoS) against the Trusted Execution Environment (TEE).\nAffected systems include OP-TEE OS versions through 4.10.0 when the CFG_WIDEVINE_PTA configuration flag is enabled.\nRisk implications involve total compromise of TEE availability, resulting in system instability or crashes at Secure Exception Level 1 (S-EL1).\nAttacker capabilities are limited to causing a denial of service, requiring execution privileges in the Normal World client environment.\nExploitation requires the CFG_WIDEVINE_PTA configuration to be active and the ability for Normal World clients to interact directly with the Trusted Application interface.",
  "technicalDetails": "The vulnerability stems from an unconditional dereference of a NULL calling session pointer within the Widevine pseudo-TA open_session handler.\nThe vulnerable component is the Widevine pseudo-TA open_session handler, specifically invoked via the function is_user_ta_ctx() inside OP-TEE OS.\nAffected software versions comprise OP-TEE OS through 4.10.0.\nAuthentication and privilege requirements involve access from a Normal World client capable of issuing direct session opening requests to the TEE driver and pseudo-TAs.\nNetwork exposure is local to the device, as TEE interactions typically occur via internal messaging interfaces between the Normal World and Secure World.\nThe attack flow begins when an unprivileged or privileged Normal World client initiates an open session request directly targeted at the Widevine pseudo-TA.\nDuring the handling of this open session request, the execution path reaches the Widevine pseudo-TA open_session handler without establishing a valid calling session context.\nThe handler subsequently executes a function such as is_user_ta_ctx(), which attempts to access the calling session pointer.\nBecause the pointer is NULL and the dereference is unconditional, the Secure World immediately encounters a memory fault at Secure Exception Level 1 (S-EL1).\nThis unhandled exception triggers a crash of the trusted execution environment, effectively terminating secure services and achieving a denial of service."
}