OP-TEE OS - Heap Underwrite in mbedTLS

Executive Summary

sw_crypto_acipher_rsanopad_encrypt() and sw_crypto_acipher_rsanopad_decrypt() in lib/libmbedtls/core/rsa.c copy the caller's input into a modulus-sized scratch buffer so that it sits flush against the end of the buffer. The destination is computed as buf + rsa.len - src_len with no check that src_len <= rsa.len. Both values are size_t, so an input longer than the modulus makes the subtraction wrap to a very large unsigned value and the destination resolves to an address below buf. The following memcpy then writes the entire attacker-supplied input starting there, underwriting the OP-TEE core heap by however many bytes the input exceeded the modulus.

Details

The encrypt path allocates a fixed-size scratch buffer and performs the right-aligned copy without validating the input length:

rsa.len = crypto_bignum_num_bytes((void *)&rsa.N);   /* modulus length */

blen = CFG_CORE_BIGNUM_MAX_BITS / 8;
buf = malloc(blen);
...
memset(buf, 0, blen);
memcpy(buf + rsa.len - src_len, src, src_len);       /* no length check */

For a well-formed input (src_len <= rsa.len) the offset rsa.len - src_len is small and positive and the value lands at the end of the buffer, as intended. For src_len > rsa.len the subtraction underflows, buf + (huge value) wraps back below buf, and the copy runs from buf - (src_len - rsa.len) forwards, so the first src_len - rsa.len bytes land before the allocation.

The decrypt path in the same file carries the identical statement at lib/libmbedtls/core/rsa.c:426.

Impact

Code execution at S-EL1, the highest privilege level in the Secure World.

Duplicate and Independent Discovery

This issue was found independently by Argus CSR and by Ramtine Tofighi Shirazi ([email protected]) of Secmate.dev.

Remediation

Update to an OP-TEE OS core containing a21b322e86af ("drivers: crypto: harden crypto_acipher_rsanopad_{de,en}crypt()"), merged as 7b8b494e0a32. It rejects an input longer than the modulus before the copy is computed.

Timeline

• 2026-06-24 — Reported to the OP-TEE project with proof-of-concept code
• 2026-07-30 — Fix submitted upstream as PR #7898
• 2026-08-03 — Independently reported fix merged upstream as 7b8b494e0a32 (PR #7808)
• 2026-08-04 — PR #7898 closed as a duplicate of the merged fix
• 2026-08-06 — Public disclosure