OP-TEE OS - Secure World Panic via NULL Calling Session in the Widevine PTA

Executive Summary

The Widevine pseudo-TA restricts itself to a small set of allowed caller UUIDs. To do that, open_session() in core/pta/widevine.c looks up the calling session and immediately reads through it:

struct ts_session *session = ts_get_calling_session();

/* Make sure we are called from a TA */
if (!is_user_ta_ctx(session->ctx))
    return TEE_ERROR_ACCESS_DENIED;

The check assumes a calling session always exists. When the Normal World opens a session on the PTA directly, there is no calling TA on the thread's session stack, ts_get_calling_session() returns NULL, and the very next statement dereferences it. The fault happens at S-EL1 and brings down the OP-TEE core.

Details

ts_get_calling_session() returns the session below the current one on the thread's session stack, which is the caller's session when a Trusted Application invokes the PTA. A direct Normal World open leaves nothing below the PTA's own session, so the function returns NULL rather than a session belonging to a non-TA caller. The guard that was meant to reject non-TA callers is therefore written the wrong way round: it reads the field it needs before it has established that the pointer it came from is valid, and the "not called from a TA" case is exactly the case that makes the pointer NULL.

The UUID allow-list that follows never runs, so the intended access control is not what fails here; the dereference happens first.

Impact

The core panics. Every Secure World service the platform depends on, including secure storage, key handling, attestation, and DRM, is unavailable until the device reboots, and any Normal World process that can reach the TEE device can trigger it at will.

Remediation

Update to an OP-TEE OS core containing 83db7cc0e5b7 ("core: pta: widevine: reject a NULL calling session in open_session"), merged as 0aadfc23407f. The fix rejects the call with TEE_ERROR_ACCESS_DENIED when there is no calling session, before anything is read through the pointer.

Timeline

• 2026-06-24 — Reported to the OP-TEE project with proof-of-concept code
• 2026-07-30 — Fix submitted upstream as PR #7899
• 2026-08-06 — Fix merged upstream as 0aadfc23407f
• 2026-08-06 — Public disclosure