OP-TTEE SHA-3/RSA Accelerator Heap Overflow Vulnerabilities Analysis (CVE-2026-40257/CVE-2026-33662)

--- Vulnerability Overview SecMate’s automated analysis identified three memory safety vulnerabilities in OP-TTEE (the open-source Trusted Execution Environment operating system for Arm TrustZone), all located within the privileged OP-TTEE core. These vulnerabilities lead to memory corruption, compromising both confidentiality and integrity. SHA-3 Accelerate Finalize Heap Overflow (CVE-2026-40257) RSASSA PKCS#1 v1.5 Encoding Underflow (CVE-2026-33662) SE050 RSA NOPAD Heap Underflow (No CVE assigned, classified as a bug by OP-TTEE) All vulnerabilities stem from unsigned arithmetic wraparound, resulting in out-of-bounds buffer writes that breach the isolation boundary between the Secure World and the Normal World. --- Scope of Impact SHA-3 Vulnerability: Affects platforms utilizing the Arm v8.2 SHA-3 acceleration path (CAAM, HiSilicon, Versal, SE050). Present in 13 public OP-TTEE versions. RSASSA Vulnerability: Affects platforms using and RSA acceleration drivers (NXP CAAM, Xilinx Versal, HiSilicon, SE050). SE050 Vulnerability: Affects only the NXP SE050 RSA driver and remains present in the upstream codebase. Attackers can trigger these vulnerabilities via legitimate Trusted Applications (TAs) to perform controlled writes, potentially causing crashes in the Secure World or data leakage. --- Remediation 1. SHA-3 Accelerate Finalize Heap Overflow (CVE-2026-40257) Remediation Steps: Change the comparison condition from to to ensure complete blocks are compressed by hardware. Add defensive assertion to verify . Configuration flag: Post-fix Code Snippet: 2. RSASSA PKCS#1 v1.5 Encoding Underflow (CVE-2026-33662) Remediation Steps: Add a lower-bound check in to prevent negative padding byte calculations. Original Problematic Code: Remediation Suggestion: Add validation to ensure is non-negative. 3. SE050 RSA NOPAD Heap Underflow (No CVE Assigned) Remediation Steps: Currently unpatched; remains in the upstream codebase (as of July 13, 2026). Manual addition of boundary checks is required to prevent wraparound of . --- POC / Exploitation Code SHA-3 Vulnerability POC (Reproduced with ASAN) SHA-3 Vulnerability Trigger Logic (Pseudocode) When the input is exactly one block (136 bytes) and the buffer is empty, evaluates to false, skipping hardware compression. The entire block is copied to , causing to equal . Subsequently, the operation writes approximately 4GB of zero values, resulting in a heap overflow. --- Summary All three vulnerabilities originate from incorrect assumptions about unsigned arithmetic results, leading to out-of-bounds buffer writes. Remediation requires strengthening boundary checks and type safety. The SHA-3 and RSASSA vulnerabilities have been fixed, while the SE050 vulnerability still requires an upstream fix. ---

Goal Reached Thanks to every supporter — we hit 100%!

OP-TTEE SHA-3/RSA Accelerator Heap Overflow Vulnerabilities Analysis (CVE-2026-40257/CVE-2026-33662)