OP-TEE optee_os up to 4.10.0 Trusted Execution Environment ta/pkcs11/src/object.c entry_get_attribute_value out-of-bounds

Summaryinfo

A vulnerability identified as critical has been detected in OP-TEE optee_os up to 4.10.0. Affected by this vulnerability is the function entry_get_attribute_value of the file ta/pkcs11/src/object.c of the component Trusted Execution Environment. The manipulation leads to out-of-bounds. This vulnerability is traded as CVE-2026-33317. An attack has to be approached locally. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in OP-TEE optee_os up to 4.10.0 and classified as critical. This issue affects the function entry_get_attribute_value of the file ta/pkcs11/src/object.c of the component Trusted Execution Environment. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()` in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE` or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-33317 since 03/18/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 310393 (Linux Distros Unpatched Vulnerability : CVE-2026-33317), which helps to determine the existence of the flaw in a target environment.

Applying the patch 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (310393). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• OP-TEE

Name

• optee_os

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10.0

License

• open-source

Website

• Product: https://github.com/OP-TEE/optee_os/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion