CVE-2026-71967: 
Linux Debian 脆弱性の分析と軽減

CVE-2026-71967 is a NULL pointer dereference vulnerability in OP-TEE OS affecting all versions through 4.10.0. It resides in the Widevine pseudo-Trusted Application (pseudo-TA) open_session handler and allows low-privileged Normal World clients to crash the Trusted Execution Environment (TEE) when CFG_WIDEVINE_PTA is enabled. The vulnerability was disclosed on August 10, 2026, and fixed in commit 0aadfc2 merged on August 6, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 5.7 (Medium) (Github Advisory, OP-TEE PR #7899).

The root cause is a NULL pointer dereference (CWE-476) in core/pta/widevine.c. The open_session() function calls ts_get_calling_session() to retrieve the calling TA session, then immediately dereferences the returned pointer via is_user_ta_ctx(session->ctx) without first checking whether session is NULL. When a Normal World client sends an OPTEE_MSG_CMD_OPEN_SESSION command directly to the Widevine PTA — bypassing any intermediary TA — no calling session exists on the stack, so ts_get_calling_session() returns NULL. The subsequent dereference faults at S-EL1, panicking the TEE. The fix (a one-line change) adds a NULL guard: if (!session || !is_user_ta_ctx(session->ctx)), consistent with how other PTAs already handle this case (OP-TEE Commit, OP-TEE PR #7899).

Successful exploitation causes a complete crash of the Trusted Execution Environment at S-EL1, resulting in a denial of service for all TEE-dependent functionality on the affected device. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Any services relying on the TEE (e.g., DRM, secure storage, cryptographic operations) would be disrupted until the device is rebooted or the TEE is restarted (Github Advisory, OP-TEE PR #7899).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access with low privileges and the non-default CFG_WIDEVINE_PTA build option to be enabled, limiting the attack surface (Github Advisory, OP-TEE PR #7899).

1. Prerequisite check: Confirm the target device runs OP-TEE OS ≤ 4.10.0 compiled with CFG_WIDEVINE_PTA=y (the Widevine pseudo-TA must be enabled in the build configuration).
2. Obtain local access: Gain low-privileged code execution in the Normal World (Linux userspace or equivalent) on the target device.
3. Open session directly on Widevine PTA: Use the OP-TEE client library (e.g., libteec) or a raw OPTEE_MSG_CMD_OPEN_SESSION ioctl to the /dev/tee0 device, targeting the Widevine PTA UUID directly — without routing through an intermediary Trusted Application.
4. Trigger NULL dereference: Because no calling TA session is on the TEE stack, ts_get_calling_session() returns NULL. The unguarded is_user_ta_ctx(session->ctx) dereference faults at S-EL1.
5. TEE crash: The fault panics the TEE, crashing the trusted execution environment and causing a denial of service for all TEE-dependent services on the device (OP-TEE PR #7899, OP-TEE Commit).

• Logs: Unexpected TEE panic or S-EL1 fault messages in the secure monitor or kernel logs (e.g., tee_ioctl errors, TEE driver crash messages in dmesg).
• Process/System Behavior: Sudden unavailability of TEE-dependent services (DRM playback failures, secure storage errors, cryptographic service timeouts) following an OPTEE_MSG_CMD_OPEN_SESSION call targeting the Widevine PTA UUID.
• Kernel/Driver: Repeated or unexpected open-session attempts to /dev/tee0 or /dev/teepriv0 from unprivileged processes not associated with a legitimate DRM client application.

Apply the fix included in commit 0aadfc23407f50e770eb5ddd871fc208f5626833, which adds a NULL check for the calling session pointer before dereferencing it in open_session(). If upgrading is not immediately feasible, disable the Widevine pseudo-TA by rebuilding OP-TEE OS without CFG_WIDEVINE_PTA=y if Widevine support is not required. Additionally, restricting Normal World access to the TEE device node (/dev/tee0) to only authorized processes can reduce exposure (OP-TEE Commit, Github Advisory).