OP-TEE vulnerabilities

A 32-bit integer overflow vulnerability exists in the AES-GCM implementation of the OP-TEE core. After processing more than 512 megabytes of payload or Additional Authenticated Data (AAD), the authentication tag is computed with incorrect bit-length values.

In OP-TEE from version 3.20.0 to 4.10.0, a vulnerability exists in the subkey rollback protection mechanism. The `shdr_load_pub_key()` function fails to assign the subkey version to the runtime structure, leaving the version field at zero. Consequently, the version update check (`check_update_version()`) does not record the correct version, allowing Trusted Applications (TAs) signed with older or revoked subkeys to load successfully.

In OP-TEE from version 3.3.0 to 4.10.0, a resource leak exists in the `cleanup_shm_refs()` function due to missing bitmask application on parameter attributes. This skips the `mobj_put()` call for non-contiguous memory parameters, causing a persistent leak of `mobj_reg_shm` objects and exhaustion of the secure-world heap.

The RSA PKCS#1 v1.5 implementation in the Hisilicon HPRE crypto driver in OP-TEE is vulnerable to a Bleichenbacher-style attack. Non-constant-time `memcmp()` and distinguishable error paths allow an attacker to recover plaintext.

The RSA-OAEP decryption in the NXP CAAM crypto driver for OP-TEE (versions 3.9.0 to 4.10.0) uses non-constant-time `memcmp()` for label hash verification and has distinguishable error paths. This allows an attacker to recover RSA-OAEP plaintext with approximately 1000-2000 adaptive chosen ciphertext queries via a Manger-style padding oracle.

The RSA-OAEP implementation in the Hisilicon HPRE crypto driver in OP-TEE is vulnerable to a padding oracle attack. Non-constant-time memcmp() for label hash verification and distinguishable error paths allow plaintext recovery with approximately 1000-2000 adaptive chosen ciphertext queries.

In OP-TEE from version 3.10.0 to 4.10.0, an unbounded recursion vulnerability in the PKCS#11 TA can cause a system crash. The issue is fixed in version 4.11.0.

An off-by-one error in the ARM Crypto Extensions accelerated SHA-3 implementation in OP-TEE can cause a massive heap overflow, corrupting all TEE kernel memory after the hash state. Affected versions are from 3.21.0 to 4.11.0 with `CFG_CRYPTO_WITH_CE82=y`.

A type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world, affecting versions 4.3.0 through 4.11.0. This only applies when configured as an SPMC for S-EL0 SPs.

OP-TEE before version 4.11.0 does not verify that an ECDH public key lies on the correct curve. An attacker in the normal world can send about 30-40 crafted public keys to reconstruct the private key.

In OP-TEE versions 3.16.0 through 4.10.0, a use-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A SPMC/SP flows, where a thread calling sp_mem_remove() without a lock can free objects while another thread dereferences them.