A critical integer overflow vulnerability in OP-TEE versions 3.8.0 through 4.10 allows unauthenticated attackers to trigger a denial of service on affected Arm-based systems.

The flaw exists in the emsa_pkcs1_v1_5_encode() function within the RSA acceleration component, where an integer underflow during padding calculation leads to an out-of-bounds memory operation via memset(). This vulnerability is exploitable by an unauthenticated attacker, specifically affecting platforms that utilize RSA acceleration.

Successful exploitation of this vulnerability results in a system crash, causing a denial of service for the Trusted Execution Environment. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to system availability, particularly for secure boot or cryptographic operations that rely on the integrity of the TEE. Impact is localized to the TEE, but the resulting service disruption could prevent secure authentication or hardware-backed security functions from operating correctly.

Immediate Action: Update OP-TEE to a patched version as specified in the official GitHub security advisory (GHSA-4cf8-v5g3-73gr).

Proactive Monitoring: Monitor system logs for unexpected TEE restarts or cryptographic driver failures that may indicate an attempt to trigger the memory overwrite.

Compensating Controls: If patching is not immediately feasible, restrict access to services that invoke RSA acceleration functions until the underlying code is updated to perform proper bounds checking.

Public Exploit Available: Unknown

This vulnerability represents a significant stability risk for systems relying on OP-TEE for secure operations. Organizations should prioritize updating to the fixed version provided by Linaro to prevent potential denial of service attacks that could cripple hardware-backed security features.