CVE-2026-41514
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The RSA-OAEP implementation in the Hisilicon HPRE crypto driver in OP-TEE is vulnerable to a padding oracle attack. Non-constant-time memcmp() for label hash verification and distinguishable error paths allow plaintext recovery with approximately 1000-2000 adaptive chosen ciphertext queries.
Risk Assessment
An attacker can decrypt RSA-OAEP protected data, compromising confidentiality of processed information in the TEE environment. Only affects plat-d06 with CFG_HISILICON_ACC_V3=y, which is disabled by default.
Recommendation
Upgrade OP-TEE to version 4.11.0 or later. As a workaround, disable the Hisilicon HPRE RSA driver by setting CFG_HISILICON_ACC_V3=n.
Original NVD description (English source)
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.5.0 and prior to version 4.11.0, the RSA-OAEP decryption implementation in the Hisilicon HPRE crypto driver uses non-constant-time `memcmp()` for label hash verification and has multiple distinguishable error paths. This creates a Manger-style padding oracle that allows an attacker to recover RSA-OAEP plaintext with approximately 1000-2000 adaptive chosen ciphertext queries. Only affects plat-d06 with `CFG_HISILICON_ACC_V3=y`, which seems to be disabled by default. Version 4.11.0 contains a patch. As a workaround, disable Hisilicon HPRE RSA driver with `CFG_HISILICON_ACC_V3=n`.