Source: optee-os Version: 4.10.0-2 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for optee-os. CVE-2026-71967[0]: | OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null | pointer dereference vulnerability in the Widevine pseudo-TA | open_session handler that allows Normal World clients to cause a | denial of service when CFG_WIDEVINE_PTA is enabled. Attackers can | open a session directly on the Widevine PTA to trigger an | unconditional dereference of a NULL calling session pointer via | is_user_ta_ctx(), faulting the TEE at S-EL1 and crashing the trusted | execution environment. CVE-2026-71968[1]: | OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use- | after-free vulnerability in the Trusted Application loader that | allows attackers with the ability to load a signed Trusted | Application to corrupt secure-world kernel memory by setting the | TA_FLAG_CONCURRENT flag in a user TA signed header. Attackers can | cause two concurrent sessions to operate on the same shared context | without locking, corrupting the uctx->vm_info.regions list during | memref parameter mapping and unmapping to free vm_region nodes still | in use, resulting in a use-after-free in S-EL1 secure-world kernel | memory. CVE-2026-71969[2]: | OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer | underwrite vulnerability in the RSA NOPAD encrypt and decrypt | operations within the mbedTLS software backend and SE050 hardware | driver that allows a malicious Trusted Application to corrupt | secure-world heap memory by supplying an input length exceeding the | RSA modulus size. When src_len exceeds rsa_len, the subtraction | expression wraps to a large unsigned value, causing a subsequent | memcpy to write attacker-controlled data before the destination | buffer in S-EL1 secure-world heap memory. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-71967 https://www.cve.org/CVERecord?id=CVE-2026-71967 [1] https://security-tracker.debian.org/tracker/CVE-2026-71968 https://www.cve.org/CVERecord?id=CVE-2026-71968 [2] https://security-tracker.debian.org/tracker/CVE-2026-71969 https://www.cve.org/CVERecord?id=CVE-2026-71969 Regards, Salvatore
