OP-TEE OS - RSA NOPAD Heap Underwrite in the NXP SE050 Crypto Driver

Executive Summary

decrypt_nopad() and encrypt_nopad() in core/drivers/crypto/se050/core/rsa.c right-align the caller's input in a scratch buffer with memcpy(buf + rsa_len - src_len, src, src_len) and never check that src_len <= rsa_len. Both are size_t, so an input longer than the modulus wraps the subtraction to a very large unsigned value, the destination resolves below buf, and the copy writes the attacker's input starting there.

Details

Both functions follow the same shape. The scratch buffer comes from the mempool, the modulus size is read from the key, and the copy is computed straight from the difference:

buf = mempool_calloc(mempool_default, 1, blen);
...
rsa_len = crypto_bignum_num_bytes(key->n);
memcpy(buf + rsa_len - src_len, src, src_len);   /* no length check */

In the current tree that is core/drivers/crypto/se050/core/rsa.c:356 in decrypt_nopad() (allocation at 349, modulus at 355) and :418 in encrypt_nopad() (allocation at 411, modulus at 417). With rsa_len 256 and src_len 257, the offset becomes 0xFFFFFFFFFFFFFFFF and the copy begins one byte before the allocation, running forward over it.

The driver is compiled when the SE050 RSA driver is enabled, CFG_NXP_SE05X_RSA_DRV, which defaults to y wherever the SE050 crypto driver itself is built.

Impact

Code execution at S-EL1, the highest privilege level in the Secure World.

Remediation

Update to an OP-TEE OS core containing b34895c098ec ("crypto: drivers: se050: check src_len <= modulus size"), merged as 7b8b494e0a32. It adds the bounds check to both NOPAD paths before the offset is computed.

Duplicate and Independent Discovery

This issue was found independently by Argus CSR and by Ramtine Tofighi Shirazi ([email protected]) of Secmate.dev.

Timeline

• 2026-06-24 — Reported to the OP-TEE project with proof-of-concept code
• 2026-07-30 — Fix submitted upstream as PR #7898
• 2026-08-03 — Independently reported fix merged upstream as 7b8b494e0a32 (PR #7808)
• 2026-08-04 — PR #7898 closed as a duplicate of the merged fix
• 2026-08-06 — Public disclosure