Executive brief
OP-TEE is a secure software layer used on Arm-based devices to protect sensitive data and operations from the main operating system. A flaw in its encryption component means that when processing large amounts of data (over 512 MB), the system fails to properly verify the data's integrity. This could allow a local attacker to bypass security checks, potentially leading to the acceptance of modified or malicious data as authentic.
Technical details
An integer overflow vulnerability exists in the `ghash_update_lengths()` function of the OP-TEE core AES-GCM implementation. When processing more than 512 MB of payload or Additional Authenticated Data (AAD), 32-bit integer arithmetic used to convert byte lengths to bit lengths overflows, resulting in an incorrect authentication tag. Additionally, the internal state tracks processed bytes using 32-bit integers, leading to further overflows at 4 GB. A local attacker could exploit this to cause authentication tag clashes or bypass integrity guarantees for large data sets. The issue is resolved in version 4.11.0 by migrating to 64-bit length counters and enforcing NIST SP 800-38D limits.
Affected products
- OP-TEE optee_os >= 3.0.0, < 4.11.0
Timeline
- 2026-03-02: disclosed: Report received by vendor
- 2026-06-02: patched: Fix published
- 2026-06-02: advisory: GitHub advisory published
- 2026-07-06: advisory: NVD published date