GHSA-w62j-7q63-7p9m: Out-of-Bounds Read in ESP-Tee Secure Service Wrappers on ESP32

Vulnerability Overview Vulnerability Name: Out-of-Bounds Read in ESP-Tee Secure Service Wrappers Vulnerability ID: GHSA-w62j-7q63-7p9m Release Date: May 13, 2023 Severity: High (CVSS v3 base metrics: 7.1 / 10) CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Description The ESP-Tee secure service wrappers, located in and , only partially validate caller-provided pointer arguments and fail to validate input pointer arguments. Since the underlying hardware peripherals protected by the TEE (such as ECC, SHA, and SPI) operate in RISC-V Machine Mode (M-mode) with full address space access permissions, a caller can pass a pointer to TEE-exclusive memory as input. This causes the peripheral to read from TEE memory and return results derived from that TEE memory to the Rich Execution Environment (REE). According to the wrappers, these results contain random bytes from TEE memory, recoverable portions of computed functions within TEE memory, or an oracle for incremental disclosure of sensitive TEE data through repeated or single calls. Impact Unprotected REE applications can read sensitive TEE data across the REE/TEE isolation boundary. This exposes TEE code and data, including encryption keys and other application secrets stored within the TEE. It also exposes code and data addresses as well as internal pointers, thereby undermining mitigation measures designed to protect the TEE and prevent subsequent memory corruption attacks. Attackers only require local code execution within the REE and do not need TEE privileges. This issue affects ESP32 SoCs with ESP-Tee support: ESP32-C3, ESP32-C6, ESP32-C61, and ESP32-H2. Remediation All ESP-Tee secure service wrappers now enforce strict context validation and buffer end address checks via the overflow-safe helper and . Pointer range checks ensure that any TEE-resident addresses are rejected before being passed to the underlying peripherals. Patch Commits Workarounds No runtime workaround is currently available. Users are advised to update to a release version containing the fix or cherry-pick the above patch commits into their downstream branches. Acknowledgments Thanks to Eunob / Espion Worker for reporting this vulnerability and adhering to responsible disclosure practices.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-w62j-7q63-7p9m: Out-of-Bounds Read in ESP-Tee Secure Service Wrappers on ESP32

More from this source