OP-TEE optee_os 4.5.0 exceptional condition

Summaryinfo

A vulnerability was found in OP-TEE optee_os 4.5.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to exceptional condition. This vulnerability is documented as CVE-2025-46733. The attack needs to be performed locally. There is not any exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in OP-TEE optee_os 4.5.0. This issue affects an unknown code block. The manipulation with an unknown input leads to a exceptional condition vulnerability. Using CWE to declare the problem leads to CWE-755. The product does not handle or incorrectly handles an exceptional condition. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In version 4.5.0, using a specially crafted tee-supplicant binary running in REE userspace, an attacker can trigger a panic in a TA that uses the libutee Secure Storage API. Many functions in libutee, specifically those which make up the Secure Storage API, will panic if a system call returns an unexpected return code. This behavior is mandated by the TEE Internal Core API specification. However, in OP-TEE’s implementation, return codes of secure storage operations are passed through unsanitized from the REE tee-supplicant, through the Linux kernel tee-driver, through the OP-TEE kernel, back to libutee. Thus, an attacker with access to REE userspace, and the ability to stop tee-supplicant and replace it with their own process (generally trivial for a root user, and depending on the way permissions are set up, potentially available even to less privileged users) can run a malicious tee-supplicant process that responds to storage requests with unexpected response codes, triggering a panic in the requesting TA. This is particularly dangerous for TAs built with `TA_FLAG_SINGLE_INSTANCE` (corresponding to `gpd.ta.singleInstance` and `TA_FLAG_INSTANCE_KEEP_ALIVE` (corresponding to `gpd.ta.keepAlive`). The behavior of these TAs may depend on memory that is preserved between sessions, and the ability of an attacker to panic the TA and reload it with a clean memory space can compromise the behavior of those TAs. A critical example of this is the optee_ftpm TA. It uses the kept alive memory to hold PCR values, which crucially must be non-resettable. An attacker who can trigger a panic in the fTPM TA can reset the PCRs, and then extend them PCRs with whatever they choose, falsifying boot measurements, accessing sealed data, and potentially more. The impact of this issue depends significantly on the behavior of affected TAs. For some, it could manifest as a denial of service, while for others, like the fTPM TA, it can result in the disclosure of sensitive data. Anyone running the fTPM TA is affected, but similar attacks may be possible on other TAs that leverage the Secure Storage API. A fix is available in commit 941a58d78c99c4754fbd4ec3079ec9e1d596af8f.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-46733 since 04/28/2025. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

Applying the patch 941a58d78c99c4754fbd4ec3079ec9e1d596af8f is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-20017). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• OP-TEE

Name

• optee_os

Version

• 4.5.0

Website

• Product: https://github.com/OP-TEE/optee_os/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion