CVE-2026-41514 Overview
CVE-2026-41514 is a padding oracle vulnerability in OP-TEE, the Trusted Execution Environment (TEE) that runs alongside a non-secure Linux kernel on Arm Cortex-A cores using TrustZone. The RSA-OAEP decryption routine in the Hisilicon HPRE crypto driver uses non-constant-time memcmp() for label hash verification and exposes multiple distinguishable error paths. This behavior creates a Manger-style oracle that allows a local attacker to recover RSA-OAEP plaintext with roughly 1000-2000 adaptive chosen ciphertext queries. The issue affects OP-TEE versions 4.5.0 through 4.10.x on plat-d06 when built with CFG_HISILICON_ACC_V3=y. The flag is disabled by default, limiting the exposed attack surface.
Critical Impact
A local, low-privileged attacker on affected plat-d06 builds can recover RSA-OAEP plaintext by exploiting timing and error-path side channels in the HPRE driver.
Affected Products
- Trustedfirmware OP-TEE versions 4.5.0 through 4.10.x
- OP-TEE builds targeting plat-d06 with CFG_HISILICON_ACC_V3=y
- Hisilicon HPRE crypto driver RSA-OAEP decryption path
Discovery Timeline
- 2026-07-06 - CVE-2026-41514 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-41514
Vulnerability Analysis
The vulnerability resides in the RSA-OAEP (Optimal Asymmetric Encryption Padding) decryption implementation of the Hisilicon HPRE crypto driver within OP-TEE. During decryption, the driver compares the OAEP label hash against the expected value using standard memcmp(), which returns as soon as the first differing byte is found. The comparison time therefore leaks information about how many leading bytes match. Additionally, distinct error paths return different status codes depending on where decoding fails, giving an attacker multiple observable signals per query. This behavior matches the classical Manger attack profile against RSA-OAEP [CWE-208 Observable Timing Discrepancy].
Root Cause
The root cause is the use of non-constant-time comparison on secret-dependent data combined with early-exit error handling. RSA-OAEP requires that any padding, label, or integrity failure be indistinguishable to the caller. The HPRE driver violates this requirement by exposing both timing differences from memcmp() and semantically distinct error codes for different failure modes in the decoding process.
Attack Vector
Exploitation requires local access to the non-secure world with the ability to invoke the affected Trusted Application through OP-TEE's client API. The attacker submits adaptively chosen ciphertexts and observes response codes and timing to bisect the plaintext. Approximately 1000-2000 queries are sufficient to recover an RSA-OAEP message. Because the attack path runs entirely within a single device and requires low privileges, remote exploitation is not possible without prior local access.
No public proof-of-concept code is available. See the OP-TEE GitHub Security Advisory for the maintainer's technical description.
Detection Methods for CVE-2026-41514
Indicators of Compromise
- High volumes of RSA-OAEP decryption invocations from a single Client Application against the HPRE-backed Trusted Application
- Repeated decryption failures with varied ciphertexts targeting the same key handle
- Unusual scheduling patterns on plat-d06 cores associated with HPRE crypto operations
Detection Strategies
- Audit OP-TEE build configurations for CFG_HISILICON_ACC_V3=y on plat-d06 targets
- Instrument the TEE supplicant and REE-side logs to record RSA-OAEP decryption error codes and invocation counts per session
- Rate-limit or alert on adaptive chosen-ciphertext patterns against RSA keys stored in the secure world
Monitoring Recommendations
- Ingest OP-TEE and kernel logs into a centralized data lake and alert on abnormal crypto API call volumes
- Track per-process invocation counts of TEEC_InvokeCommand targeting RSA decryption commands
- Correlate decryption error bursts with process identity to isolate the responsible workload
How to Mitigate CVE-2026-41514
Immediate Actions Required
- Upgrade OP-TEE to version 4.11.0 or later on all plat-d06 deployments
- Inventory firmware images and identify any build with CFG_HISILICON_ACC_V3=y
- Restrict local access to devices exposing the HPRE-backed Trusted Application to trusted workloads only
Patch Information
OP-TEE version 4.11.0 contains the fix. The patch replaces the non-constant-time label hash comparison with a constant-time equivalent and consolidates error handling so that RSA-OAEP failures return a single, indistinguishable status. Refer to the OP-TEE GitHub Security Advisory GHSA-qw4r-9wj9-q23r for the upstream fix.
Workarounds
- Disable the Hisilicon HPRE RSA driver by rebuilding OP-TEE with CFG_HISILICON_ACC_V3=n
- Route RSA-OAEP operations to a software crypto backend that implements constant-time OAEP decoding
- Limit which Client Applications can invoke RSA decryption commands on affected devices
# Configuration example - disable the vulnerable driver at build time
make PLATFORM=hisilicon-d06 CFG_HISILICON_ACC_V3=n
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
