Executive brief
Google Trusty is a secure execution environment that runs on Pixel devices to handle sensitive operations like fingerprint processing and hardware key management. A race condition in the trusty_dputc function allows a local attacker with system privileges to write data outside allocated memory bounds, potentially leading to unauthorized system control or data corruption.
Technical details
A race condition exists in the trusty_dputc function of generic-arm64-smcall.c in Google Trusty, leading to an out-of-bounds write vulnerability. The vulnerability is reachable locally with System execution privileges and does not require user interaction for exploitation. An attacker with system-level access can exploit this race condition to write beyond memory boundaries, achieving local privilege escalation within the Trusty environment.
Affected products
- Google Trusty Unspecified; patch available as of 2026-09-05 security patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched: Google Pixel devices received updates to 2026-09-05 patch level addressing this issue