{"id":"CVE-2026-33317","aliases":["DEBIAN-CVE-2026-33317","EUVD-2026-25379","GHSA-8cqw-mg7v-c9p9","UBUNTU-CVE-2026-33317"],"status":"published","title":"OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure","description":"OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()`  in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE`  or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00185,"percentile":0.08219,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-125","CWE-787"],"published":"2026-04-24T02:20:55Z","modified":"2026-10-28T10:49:27Z","exploits":[{"source":"pocgithub","id":"0xbbdd/CVE-2026-33317","title":"0xbbdd/CVE-2026-33317","date":"2026-04-30","url":"https://github.com/0xbbdd/CVE-2026-33317"}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"optee-os","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10.0-1","4.10.0-2","4.5.0-2","4.7.0-1","4.8.0-1","4.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"optee-os","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.0-1","4.5.0-2","4.7.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"optee-os","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-1","4.10.0-1","4.10.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"optee-os","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.0-1","4.8.0-1"]}],"products":[{"vendor":"op-tee","product":"optee_os"},{"vendor":"trustedfirmware","product":"op-tee"}],"references":[{"url":"https://github.com/OP-TEE/optee_os/security/advisories/GHSA-8cqw-mg7v-c9p9","tags":["x_refsource_CONFIRM","Exploit","Patch","Vendor Advisory","advisory","report"]},{"url":"https://github.com/OP-TEE/optee_os/commit/149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/OP-TEE/optee_os/commit/16926d5a46934c46e6656246b4fc18385a246900","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/OP-TEE/optee_os/commit/e031c4e562023fd9f199e39fd2e85797e4cbdca9","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33317.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33317","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33317","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-33317","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33317","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-33317","title":"OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure","description":"OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()`  in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE`  or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.","status":"published","published":"2026-04-24T02:20:55.67Z","modified":"2026-04-24T18:18:04.912Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-25379","description":"OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()`  in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE`  or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.","status":"published","published":"2026-04-24T02:20:55Z","modified":"2026-04-24T18:18:04Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:24:18.224827Z"}],"nvd":[{"id":"CVE-2026-33317","description":"OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()`  in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE`  or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.","status":"published","published":"2026-04-24T03:16:11.02Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:12:15.867234Z"}],"osv":[{"id":"CVE-2026-33317","title":"OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure","description":"OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()`  in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE`  or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.","status":"published","published":"2026-04-24T02:20:55.67Z","modified":"2026-10-28T10:49:27.70377462Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"DEBIAN-CVE-2026-33317","description":"OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()`  in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE`  or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.","status":"published","published":"2026-04-24T03:16:11.02Z","modified":"2026-10-27T09:47:33.295972594Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"UBUNTU-CVE-2026-33317","description":"OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in `entry_get_attribute_value()`  in `ta/pkcs11/src/object.c` can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function `PKCS11_CMD_GET_ATTRIBUTE_VALUE`  or `entry_get_attribute_value()` can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.","status":"published","published":"2026-04-24T03:16:00Z","modified":"2026-10-17T12:59:59.575899933Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"}]}}