Bug#1144386: optee-os: CVE-2026-71967 CVE-2026-71968 CVE-2026-71969

Source: optee-os
Version: 4.10.0-2
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerabilities were published for optee-os.

CVE-2026-71967[0]:
| OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null
| pointer dereference vulnerability in the Widevine pseudo-TA
| open_session handler that allows Normal World clients to cause a
| denial of service when CFG_WIDEVINE_PTA is enabled. Attackers can
| open a session directly on the Widevine PTA to trigger an
| unconditional dereference of a NULL calling session pointer via
| is_user_ta_ctx(), faulting the TEE at S-EL1 and crashing the trusted
| execution environment.


CVE-2026-71968[1]:
| OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-
| after-free vulnerability in the Trusted Application loader that
| allows attackers with the ability to load a signed Trusted
| Application to corrupt secure-world kernel memory by setting the
| TA_FLAG_CONCURRENT flag in a user TA signed header. Attackers can
| cause two concurrent sessions to operate on the same shared context
| without locking, corrupting the uctx->vm_info.regions list during
| memref parameter mapping and unmapping to free vm_region nodes still
| in use, resulting in a use-after-free in S-EL1 secure-world kernel
| memory.


CVE-2026-71969[2]:
| OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer
| underwrite vulnerability in the RSA NOPAD encrypt and decrypt
| operations within the mbedTLS software backend and SE050 hardware
| driver that allows a malicious Trusted Application to corrupt
| secure-world heap memory by supplying an input length exceeding the
| RSA modulus size. When src_len exceeds rsa_len, the subtraction
| expression wraps to a large unsigned value, causing a subsequent
| memcpy to write attacker-controlled data before the destination
| buffer in S-EL1 secure-world heap memory.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-71967
    https://www.cve.org/CVERecord?id=CVE-2026-71967
[1] https://security-tracker.debian.org/tracker/CVE-2026-71968
    https://www.cve.org/CVERecord?id=CVE-2026-71968
[2] https://security-tracker.debian.org/tracker/CVE-2026-71969
    https://www.cve.org/CVERecord?id=CVE-2026-71969

Regards,
Salvatore