How Researchers Bypassed OP-TEE’s TrustZone: A Full Exploit Chain on Arm Devices

OP-TEE is the Trusted Execution Environment that runs in TrustZone on Arm phones, set‑top boxes, and embedded devices, separating the system into a Normal World (Linux and regular apps) and a Secure World (OP-TEE kernel at S‑EL1 and trusted applications, TAs, at S‑EL0). ByteRay’s security team reported three vulnerabilities, each enabling a powerful primitive.

Vulnerability 1: RSA NOPAD Underflow Write‑What‑Where

RSA NOPAD is a textbook‑style no‑padding RSA where the caller provides a data block the same length as the modulus. OP‑TEE uses mbedTLS; the software path left‑aligns the input into a temporary buffer of modulus size and then performs modular exponentiation.

rsa.len = crypto_bignum_num_bytes((void *)&rsa.N); /* modulus length */
blen = CFG_CORE_BIGNUM_MAX_BITS / 8;
buf = malloc(blen);
memset(buf, 0, blen);
memcpy(buf + rsa.len - src_len, src, src_len); /* no length check */

The target address is buf + rsa.len - src_len. The intention is a right‑aligned copy, but the code never verifies src_len <= rsa.len. Because size_t is unsigned, an input longer than the modulus causes the subtraction to underflow, turning the offset into a huge value that points before buf. The subsequent memcpy writes attacker‑controlled data into whatever lies before the buffer.

Normal‑World clients invoke TEE_AsymmetricEncrypt with an RSA NOPAD key; the kernel performs the copy without any debugger or manual entry, allowing the underflow to corrupt the heap.

Heap Grooming to Achieve Write‑What‑Where

OP‑TEE’s heap is managed by BGET, a boundary‑tag allocator (see lib/libutils/isoc/bget.c). Each block has a small header with size and a prevfree field; free blocks are linked in a list and merged on release.

+--------+-----------------------------+
| header | payload                     |
+--------+-----------------------------+
  ^                               ^
  size, prevfree          pointer returned to caller

Two properties enable exploitation:

BGET allocates from the high end of a free block, so successive allocations return decreasing addresses (later objects are at lower addresses).

The bytes immediately below any live block belong either to the next object’s payload or its header.

By carefully arranging allocations, the attacker can place a victim object directly below the RSA scratch buffer. When the underflow occurs, the copy writes into the victim.

Grooming Steps

Fill the heap so that the target size class is contiguous and predictable, eliminating historic holes.

Interleave the victim objects (V) with same‑size filler objects (P).

Free one filler to create a hole exactly above the victim.

Trigger the RSA operation; the scratch buffer reuses the hole, and the underflow writes into the victim.

Step 2:   V   P   V   P   (low → high)
Step 3:   V   hole   V   P
Step 4:   V   buf   (underflow writes into V)

Targets Below the Scratch Buffer

Two classes of targets are useful:

A neighboring object containing a function pointer or ops table. Overwriting the pointer with an attacker‑chosen Secure‑World address causes an indirect call to jump to malicious code.

The allocator’s own metadata. Corrupting the boundary tag of an adjacent free block makes the next free or merge operation write attacker‑chosen values to attacker‑chosen addresses, turning the limited underflow into a full write‑what‑where primitive.

From Write to Read and Bypassing ASLR

With CFG_CORE_ASLR enabled, function‑pointer overwrites need a known address. The same underflow can be used to leak information: a victim object’s length or data pointer is copied back to Normal World, revealing a kernel address that defeats ASLR. The attacker first leaks the base address, then writes to the now‑known target.

Vulnerability 2: Widevine PTA Null‑Session Crash

The Widevine pseudo‑TA restricts callers to a whitelist of UUIDs and obtains the calling session via ts_get_calling_session(). The code assumes a session exists:

struct ts_session *session = ts_get_calling_session();
if (!is_user_ta_ctx(session->ctx))
    return TEE_ERROR_ACCESS_DENIED;

If a Normal‑World process opens a session directly, the session stack is empty, ts_get_calling_session() returns NULL, and the subsequent dereference of session->ctx triggers a fault in S‑EL1, panicking the kernel. A single SMC from an unprivileged process can thus take down the entire Secure World for any build with CFG_WIDEVINE_PTA enabled.

Vulnerability 3: Unchecked TA_FLAG_CONCURRENT

The flag TA_FLAG_CONCURRENT is documented as “pseudo‑TA only”, yet it is allowed in the flag mask that user TAs can set. The kernel checks the flag and, if set, skips the busy lock:

if (ctx->flags & TA_FLAG_CONCURRENT)
    return true; /* skip busy lock */

This permits two sessions of the same multi‑session, single‑instance user TA to run concurrently on the same shared context. Both sessions manipulate the same uctx->vm_info.regions list without locking, leading to use‑after‑free of a vm_region node. An attacker‑controlled TA can trigger this on devices that accept signed test keys; on devices with locked signatures, a signed malicious TA is required.

Current Status

All three vulnerabilities have been reported to the OP‑TEE project with proof‑of‑concept code and were patched upstream in 2026. The RSA NOPAD underflow was independently discovered by the authors and Ramtine Tofighi Shirazi.

References

OP‑TEE #7898: crypto: rsa: reject RSA NOPAD input longer than the modulus

OP‑TEE #7899: core: pta: widevine: reject a NULL calling session in open_session

OP‑TEE #7900: core: ldelf: reject TA_FLAG_CONCURRENT for user TAs