CVSS: 7.4EPSS: 0%CPEs: 2EXPL: 1CVE-2023-41325 – OP-TEE double free in shdr_verify_signature
https://notcve.org/view.php?id=CVE-2023-41325
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, `shdr_verify_signature` can make a double free. `shdr_verify_signature` used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (`sw_crypto_acipher_alloc_rsa_public_key`) will try to allocate a memory (which is optee’s heap memory). • https://github.com/OP-TEE/optee_os/commit/e2ec831cb07ed0099535c7c140cb6338aa62816a https://github.com/OP-TEE/optee_os/security/advisories/GHSA-jrw7-63cq-7vhm • CWE-415: Double Free •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-47549
https://notcve.org/view.php?id=CVE-2022-47549
An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections. Una operación de acceso a memoria desprotegida en optee_os en TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) anterior a 3.20 permite a un adversario físicamente cercano omitir la verificación de firmas e instalar aplicaciones maliciosas confiables mediante inyecciones de fallos electromagnéticas. • https://github.com/OP-TEE/optee_os/security/advisories/GHSA-r64m-h886-hw6g https://people.linaro.org/~joakim.bech/reports/Breaking_cross-world_isolation_on_ARM_TrustZone_through_EM_faults_coredumps_and_UUID_confusion.pdf • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-44149
https://notcve.org/view.php?id=CVE-2021-44149
An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a v cycle. Se ha detectado un problema en Trusted Firmware OP-TEE Trusted OS versiones hasta 3.15.0. El controlador CSU de OPTEE-OS para los dispositivos SoC NXP i.MX6UL carece de la configuración de acceso de seguridad para los registros relacionados con el wakeup, resultando en una omisión de TrustZone porque el Mundo no Seguro puede llevar a cabo operaciones de lectura/escritura de memoria arbitrarias en la memoria del Mundo Seguro. • https://github.com/OP-TEE/optee_os/tags https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0002-OP-TEE_TrustZone_bypass_at_wakeup.txt •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2021-36133
https://notcve.org/view.php?id=CVE-2021-36133
The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a DMA capable peripheral. El controlador CSU de OPTEE-OS para los dispositivos NXP i.MX SoC carece de configuración de acceso de seguridad para varios modelos, resultando en una omisión de TrustZone porque el Mundo no Seguro puede llevar a cabo operaciones arbitrarias de lectura/escritura de memoria en la memoria del Mundo Seguro. Esto implica un periférico con capacidad DMA • https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0001-OP-TEE_TrustZone_bypass.txt • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-25052
https://notcve.org/view.php?id=CVE-2019-25052
In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information. En Linaro OP-TEE versiones anteriores a 3.7.0, al usar datos inconsistentes o malformados, es posible llamar a funciones criptográficas de actualización y finalización directamente, causando un bloqueo que podría filtrar información confidencial • https://github.com/OP-TEE/optee_os/commit/34a08bec755670ea0490cb53bbc68058cafc69b6 https://github.com/OP-TEE/optee_os/security/advisories/GHSA-pgwr-qmgh-vhmf • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •