Executive brief
OP-TEE is a secure operating system used on Arm-based devices to protect sensitive data and cryptographic operations. A flaw in its PKCS#11 component allows a local attacker to crash the secure service by sending a specially crafted, deeply nested command. Because this component typically runs as a single instance, a crash disrupts all active secure sessions and can lead to a denial of service for applications relying on these security features.
Technical details
An unbounded recursion vulnerability exists in the OP-TEE PKCS#11 Trusted Application (TA) within the sanitize_client_object() and sanitize_indirect_attr() functions. A local attacker in the Normal World can trigger this by sending a PKCS#11 C_FindObjectsInit command containing a deeply nested CKA_WRAP_TEMPLATE attribute (approximately 80 levels). This exhausts the TA's 8KB stack, triggering a data-abort when the stack boundary is crossed into a read-only guard page. Since the PKCS#11 TA is a single-instance component, the resulting crash terminates all active sessions. The issue is fixed in version 4.11.0 by implementing a maximum recursion depth of 5.
Affected products
- OP-TEE optee_os >= 3.10.0, < 4.11.0
Timeline
- 2026-03-11: other: Internal patch authored
- 2026-06-26: advisory: GitHub advisory published
- 2026-07-06: disclosed: NVD publication date