CVE-2026-33662: Linaro OP-TEE DOS Vulnerability

CVE-2026-33662 Overview

CVE-2026-33662 is an integer overflow vulnerability affecting OP-TEE, a Trusted Execution Environment (TEE) designed as a companion to a non-secure Linux kernel running on Arm Cortex-A cores using TrustZone technology. The vulnerability exists in the emsa_pkcs1_v1_5_encode() function within core/drivers/crypto/crypto_api/acipher/rsassa.c, where improper calculation of padding size ("PS size") can lead to an integer underflow, ultimately causing a denial of service condition.

Critical Impact

An attacker can exploit this vulnerability to crash OP-TEE by triggering an integer underflow during RSA signature encoding, affecting the availability of trusted applications and secure services on affected platforms.

Affected Products

• Linaro OP-TEE versions 3.8.0 through 4.10
• Platforms registering RSA acceleration
• Arm Cortex-A based systems using TrustZone technology

Discovery Timeline

• 2026-04-24 - CVE CVE-2026-33662 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-33662

Vulnerability Analysis

The vulnerability resides in the EMSA-PKCS1-v1_5 encoding implementation used for RSA signature operations. When encoding a message for RSA signing, the function calculates the amount of padding required by subtracting the size of the digest and other required fields from the RSA key modulus size. This calculation assumes the modulus is always large enough to accommodate the digest and encoding overhead, but this assumption can be violated by selecting an RSA key with a sufficiently small modulus.

When a crafted key with a small modulus is used, the subtraction underflows, resulting in a very large unsigned integer value. This corrupted value is then passed to a memset() call that attempts to fill the padding buffer with 0xFF bytes. The excessive write operation causes memory corruption that ultimately crashes the OP-TEE operating system.

This vulnerability only manifests on platforms that have registered RSA hardware acceleration, limiting the attack surface to specific deployment configurations. However, on affected systems, successful exploitation results in a complete denial of service of the TEE, potentially impacting all trusted applications and secure services running within the trusted environment.

Root Cause

The root cause is an integer overflow vulnerability (CWE-190) in the padding size calculation. The emsa_pkcs1_v1_5_encode() function does not properly validate that the RSA key modulus is large enough to accommodate the required encoding elements before performing the subtraction. Without proper bounds checking, the calculation modulus_size - digest_size - overhead can wrap around to a large unsigned value when digest_size + overhead exceeds modulus_size.

Attack Vector

The attack requires the ability to provide or influence the RSA key used during signature operations. An attacker can craft a malicious RSA key with an abnormally small modulus that, when used for signing operations, triggers the integer underflow condition. The attack vector is network-accessible, meaning remote exploitation may be possible depending on how the vulnerable platform processes incoming cryptographic material.

The exploitation mechanism involves:

1. Crafting an RSA key with a modulus smaller than the combined size of the digest algorithm output and PKCS#1 v1.5 encoding overhead
2. Submitting this key for use in a signing operation through an exposed interface
3. The underflowed padding size causes memset() to write beyond buffer boundaries
4. OP-TEE crashes, denying service to all trusted applications

Detection Methods for CVE-2026-33662

Indicators of Compromise

• Unexpected OP-TEE crashes or reboots on systems using RSA acceleration
• Error logs indicating memory access violations within the TEE
• Anomalous RSA key material with unusually small modulus sizes being submitted to the system
• Repeated attempts to use malformed cryptographic keys through TEE interfaces

Detection Strategies

• Monitor TEE crash logs for patterns consistent with memory corruption in RSA signing operations
• Implement input validation logging to detect submission of RSA keys with abnormally small modulus sizes
• Deploy integrity monitoring for OP-TEE firmware to detect unexpected restarts
• Configure alerts for repeated TEE initialization sequences that may indicate exploitation attempts

Monitoring Recommendations

• Enable verbose logging for cryptographic operations within OP-TEE where possible
• Monitor system health metrics for ARM TrustZone environments to detect availability impacts
• Implement anomaly detection for cryptographic API calls with unusual parameters
• Track firmware crash dump analysis for patterns matching this vulnerability

How to Mitigate CVE-2026-33662

Immediate Actions Required

• Upgrade OP-TEE to a patched version beyond 4.10 that addresses this vulnerability
• Review and restrict access to interfaces that allow external key material to be used for RSA operations
• Implement network-level controls to limit access to systems with RSA acceleration enabled
• Consider temporarily disabling RSA hardware acceleration if patches cannot be immediately applied

Patch Information

Security updates addressing this vulnerability are tracked in the OP-TEE GitHub Security Advisory. Organizations running OP-TEE versions 3.8.0 through 4.10 should upgrade to the latest patched release. The fix involves adding proper validation to ensure the RSA modulus size is sufficient before performing the padding calculation.

Workarounds

• Disable RSA hardware acceleration on affected platforms until patches can be applied
• Implement strict input validation at application layers to reject RSA keys with modulus sizes below acceptable minimums
• Use network segmentation to isolate systems running vulnerable OP-TEE versions from untrusted networks
• Deploy application-level controls to validate RSA key parameters before passing them to TEE operations

# Configuration example
# Verify OP-TEE version and check for vulnerable configurations
# Check current OP-TEE version (method varies by platform)
cat /sys/firmware/optee/version

# Review platform configuration for RSA acceleration registration
# Consult vendor documentation for platform-specific configuration
# to disable RSA hardware acceleration as a temporary mitigation