Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2021-44149

HistoryDec 07, 2021 - 9:15 p.m.

CVE-2021-44149

2021-12-0721:15:08

Debian Security Bug Tracker

security-tracker.debian.org

trusted firmware

op-tee os

security access

nxp i.mx6ul soc

trustzone bypass

memory operations

vulnerability

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

Low

EPSS

Percentile

12.6%

JSON

An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a v cycle.

OSVersionArchitecturePackageVersionFilename
Debian999alloptee-os< 4.3.0-1optee-os_4.3.0-1_all.deb
Debian13alloptee-os< 4.3.0-1optee-os_4.3.0-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	999	all	optee-os	< 4.3.0-1	optee-os_4.3.0-1_all.deb
Debian	13	all	optee-os	< 4.3.0-1	optee-os_4.3.0-1_all.deb

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

Low

EPSS

Percentile

12.6%

JSON

Related for DEBIANCVE:CVE-2021-44149