CyberRota Analysis
AI-GeneratedThe vulnerability affects OP-TEE OS versions up to 4.10.0, specifically within the RSA NOPAD encrypt and decrypt operations of the mbedTLS software backend and SE050 hardware driver. An attacker can exploit this buffer underwrite flaw to corrupt secure-world heap memory by providing an input length that exceeds the RSA modulus size, potentially leading to unauthorized access or manipulation of sensitive data. Organizations utilizing OP-TEE OS in their secure environments should prioritize patching this vulnerability to mitigate risks associated with memory corruption and potential exploitation by malicious Trusted Applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver that allows a malicious Trusted Application to corrupt secure-world heap memory by supplying an input length exceeding the RSA modulus size. When src_len exceeds rsa_len, the subtraction expression wraps to a large unsigned value, causing a subsequent memcpy to write attacker-controlled data before the destination buffer in S-EL1 secure-world heap memory.