Description

OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver that allows a malicious Trusted Application to corrupt secure-world heap memory by supplying an input length exceeding the RSA modulus size. When src_len exceeds rsa_len, the subtraction expression wraps to a large unsigned value, causing a subsequent memcpy to write attacker-controlled data before the destination buffer in S-EL1 secure-world heap memory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-10T19:17:32.400Z",
  "pubdate": "2026-08-10T19:17:32.400Z",
  "executiveSummary": "OP-TEE OS through 4.10.0 contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations located within the mbedTLS software backend and SE050 hardware driver.\nThis vulnerability allows a malicious Trusted Application running in the secure world to corrupt S-EL1 secure-world heap memory by supplying an input length that exceeds the RSA modulus size.\nThe primary impact of successful exploitation is secure-world memory corruption, which can lead to arbitrary code execution, privilege escalation within the Trusted Execution Environment (TEE), or bypass of secure-world security controls.\nAttackers require the capability to execute code as a Trusted Application within the secure world to interact directly with the vulnerable cryptographic backend and hardware driver interfaces.\nRisk implications are severe as the vulnerability resides within the trusted computing base of OP-TEE OS, potentially compromising the confidentiality and integrity of secure-world assets and services.",
  "technicalDetails": "The vulnerability stems from an arithmetic underflow condition within the RSA NOPAD encrypt and decrypt operations implemented in the mbedTLS software backend and SE050 hardware driver of OP-TEE OS.\nSpecifically, when the provided input length (src_len) exceeds the defined RSA modulus size (rsa_len), a subtraction operation calculating the remaining buffer or offset fails to safely bound the values.\nBecause the calculation uses unsigned integers, subtracting a larger value from a smaller value (rsa_len - src_len) wraps around to a catastrophically large unsigned value.\nThis large wrapped value is subsequently passed into a memory copy operation (memcpy), tricking the runtime into treating the destination pointer offset as a massive negative distance.\nConsequently, the subsequent memcpy routine performs a buffer underwrite, writing attacker-controlled input data directly before the intended destination buffer located in S-EL1 secure-world heap memory.\nThe affected components are explicitly the RSA NOPAD handling logic within the mbedTLS software backend and the SE050 hardware driver interfaces.\nAffected software versions include OP-TEE OS through 4.10.0.\nPrerequisites for exploitation require an adversary to already possess execution privileges inside a Trusted Application running in the secure world, enabling them to invoke the cryptographic API with maliciously crafted parameters where src_len is greater than rsa_len.\nNo network exposure is directly required as the attack vector is internal to the secure-world software interface between Trusted Applications and the OP-TEE OS core cryptographic subsystems.\nPost-exploitation impact includes the corruption of adjacent secure-world heap metadata or critical function pointers, leading to reliable secure-world memory corruption, arbitrary code execution at S-EL1 privilege levels, and complete compromise of the Trusted Execution Environment."
}