A critical out-of-bounds read and write vulnerability in OP-TEE versions 3.13.0 through 4.10.0 could allow local authenticated attackers to compromise the Trusted Execution Environment.

This flaw involves an out-of-bounds read and write vulnerability (CWE-125, CWE-787) triggered by improper validation within the PKCS#11 Trusted Application. Local attackers with low privileges can manipulate template parameters to read from or write to memory outside the intended buffer boundaries.

The ability to perform out-of-bounds memory operations within a Trusted Execution Environment (TEE) poses a significant risk to the integrity and confidentiality of sensitive data processed by the secure enclave. With a CVSS score of 8.7, this vulnerability is classified as High severity, as it potentially allows for the bypass of security protections intended to isolate cryptographic keys and sensitive operations from the non-secure Linux kernel. Successful exploitation could lead to unauthorized data disclosure or system instability.

Immediate Action: Upgrade to OP-TEE version 4.11.0 or apply the upstream patches provided in commits e031c4e, 16926d5, and 149e8d7.

Proactive Monitoring: Monitor system logs for unexpected crashes or errors originating from the TEE or PKCS#11 services, which may indicate attempted memory corruption.

Compensating Controls: Ensure that access to the TEE and PKCS#11 interfaces is restricted to authorized processes only, minimizing the attack surface available to low-privileged users.

Public Exploit Available: Yes — a public proof-of-concept repository is available on GitHub.

Given the high CVSS score and the sensitive nature of the Trusted Execution Environment, organizations utilizing OP-TEE must prioritize the transition to version 4.11.0. Failure to address this vulnerability leaves critical cryptographic operations exposed to local memory manipulation. Apply the provided vendor patches immediately to restore the integrity of the secure enclave.