CVE-2026-71969: 
Linux Debian 脆弱性の分析と軽減

CVE-2026-71969 is a buffer underwrite (heap underflow) vulnerability in OP-TEE OS through version 4.10.0, affecting the RSA NOPAD encrypt and decrypt operations in both the mbedTLS software backend and the SE050 hardware driver. A malicious Trusted Application can trigger the flaw by supplying an input length (src_len) exceeding the RSA modulus size (rsa_len), causing an unsigned integer underflow in the subtraction rsa_len - src_len and a subsequent memcpy that writes attacker-controlled data before the destination buffer in S-EL1 secure-world heap memory. The vulnerability was disclosed on August 10, 2026, and is fixed in commit 7b8b494. It carries a CVSS v3.1 base score of 6.7 (High) and a CVSS v4.0 base score of 8.4 (High) (Github Advisory, Feedly).

The root cause is classified as CWE-124 (Buffer Underwrite / Buffer Underflow) and CWE-787 (Out-of-bounds Write). In the vulnerable code paths — sw_crypto_acipher_rsanopad_encrypt(), sw_crypto_acipher_rsanopad_decrypt() (mbedTLS backend), and encrypt_nopad()/decrypt_nopad() (SE050 driver) — the input is left-aligned into a modulus-sized buffer via memcpy(buf + rsa_len - src_len, src, src_len). Because both src_len and rsa_len are size_t (unsigned), when src_len > rsa_len, the subtraction wraps to a very large unsigned value, directing the memcpy to write before the start of the allocated heap buffer. The fix, applied in commit 7b8b494 via PR #7808, adds an explicit bounds check (if (src_len > rsa_len) return TEE_ERROR_BAD_PARAMETERS) in the crypto API layer and defensively in the SE050 driver; the libtomcrypt backend and hisilicon/asu drivers already performed this check (OP-TEE PR #7898, OP-TEE Commit).

Successful exploitation allows a malicious Trusted Application running in the OP-TEE secure world to corrupt S-EL1 heap memory with attacker-controlled data, resulting in high confidentiality, integrity, and availability impact within the secure-world context. An attacker could leverage this to leak cryptographic keys or other sensitive data managed by the TEE, tamper with secure-world data structures, or crash the secure OS. Because the impact is confined to the vulnerable system's secure-world context (subsequent system impact metrics are rated None), normal-world components are not directly affected, but compromise of the TEE undermines the security guarantees of all Trusted Applications running on the platform (Github Advisory, Feedly).

Exploitation requires high privileges — specifically, the ability to deploy or execute a malicious Trusted Application within the OP-TEE secure world — making this a local, high-privilege attack vector. As of the disclosure date (August 10, 2026), there is no public proof-of-concept exploit, no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, and NVD SSVC assessment confirms exploitation is rated "none" at this time. The researcher (shj-byteray) noted that a reproducer is available on request (Github Advisory, OP-TEE PR #7898, Feedly).

1. Gain Trusted Application execution: Obtain the ability to deploy or execute a Trusted Application (TA) within the OP-TEE secure world on a target device running OP-TEE OS ≤ 4.10.0. This requires high privileges (e.g., root on the normal world, or physical access to load an unsigned TA on a development device).
2. Craft a malicious TA: Develop a Trusted Application that invokes a TEE_ALG_RSA_NOPAD cryptographic operation (encrypt or decrypt) using the mbedTLS backend or SE050 driver.
3. Supply oversized input: Pass an input buffer (src) whose length (src_len) exceeds the RSA modulus size (rsa_len) — for example, for a 2048-bit (256-byte) RSA key, supply an input of 257 or more bytes.
4. Trigger integer underflow: The vulnerable code computes buf + rsa_len - src_len; since both are size_t, the subtraction underflows to a large unsigned offset, pointing far before the allocated heap buffer.
5. Achieve heap underwrite: The subsequent memcpy(buf + <huge_offset>, src, src_len) writes attacker-controlled data to memory preceding the destination buffer in S-EL1 secure-world heap, enabling corruption of adjacent heap metadata or sensitive data structures.
6. Leverage corruption: Use the heap corruption to leak cryptographic material, escalate within the secure world, or crash the secure OS depending on heap layout and target objectives (OP-TEE PR #7898, OP-TEE Commit).

• Logs: Unexpected TEE_ERROR_BAD_PARAMETERS or panic/abort messages in OP-TEE secure-world logs (tee.log) related to RSA NOPAD operations; secure-world crash dumps or unexpected reboots of the TEE.
• Process/Behavior: A Trusted Application invoking TEE_ALG_RSA_NOPAD with an input buffer larger than the RSA key modulus size; unusual TA loading activity, especially unsigned or unrecognized TAs on production devices.
• File System: Presence of unknown or unsigned Trusted Application binaries (.ta files) in the TA storage directory on the normal-world filesystem.
• Network: On development/debug builds, unexpected debug output or core dumps transmitted over UART/JTAG debug interfaces following RSA NOPAD operations (OP-TEE PR #7898).

The primary remediation is to update OP-TEE OS to a version containing commit 7b8b494e0a324cefec8ed386b7de413b44f1aaf3 or later (merged August 3, 2026 via PR #7808). The fix adds input length validation (if (src_len > rsa_len) return TEE_ERROR_BAD_PARAMETERS) in crypto_acipher_rsanopad_decrypt() and crypto_acipher_rsanopad_encrypt() in the crypto API layer, and a defense-in-depth check in the SE050 driver. As a workaround where patching is not immediately possible, restrict or audit the Trusted Applications deployed on the system to prevent untrusted or unverified TAs from performing RSA NOPAD operations (OP-TEE Commit, Github Advisory).