DirtyClone

DirtyClone CVE-2026-43503 - Python PoC 非官方的 DirtyClone Python 移植 — 一个 Linux 内核本地权限提升漏洞。 此仓库包含一个可用的概念验证 ，允许非特权本地用户通过利用通过克隆套接字缓冲区造成的页缓存损坏来获取 root 权限。 关于 DirtyClone DirtyClone CVE-2026-43503 是 Dirty 家族 （DirtyPipe → DirtyFrag → DirtyClone）的第四名成员。 它滥用了在使用带有 ESP-in-UDP 的 TEE netfilter 目标时 pskbcopyfclon...

cmcp

cMCP: Runtime MCP Confidencial Aplica la política de herramientas MCP dentro de un TEE, donde el agente que gobierna no puede alcanzarlo Inicio rápido · Arquitectura · Configuración · CLI · Registro de cambios Vista previa para desarrolladores - lanzado en la Cumbre de Computación Confidencial, 2...

optee_ftpm

OP-TEE integration for the MS TPM 2.0 Reference Implementation fTPM fTPM TA fTPM Trusted Application TA 提供了使用MS参考实现的TPM的安全固件实现。 平台特定的集成代码保存在此仓库中。 这是从MS参考实现示例ARM32-FirmwareTPM分支而来，并维护用于与OP-TEE兼容。 构建TA 此TA的构建方法如OP-TEE文档中的受信任应用程序部分所述，此外还需设置CFGMSTPM20REF，其值必须指向MS TPM 2.0参考实现的已检出副本路径。 你需要检出MS TPM...

dirtyclone-exploit

DirtyClone Exploit Framework CVE-2026-46331 — Escalada de Privilegios Local en el Kernel de Linux Corrupción de Caché de Página TC pedit + IPsec TEE · Kernels afectados: ≤ 6.12.9 root@kitploit: ╔═══════════════════════════════════════════════════════════════╗ ║ ║ ║ | \ | | / | | ║ ║ | | | | | '| ...

CVE-2022-46152

CVE-2022-46152 OP-TEE OScleanupshmrefs 越界读取漏洞复现环境 参考文档：https://optee.readthedocs.io/en/latest/building/devices/qemu.htmlqemu-v8 安全公告：https://github.com/OP-TEE/opteeos/security/advisories/GHSA-65w8-6mrg-52g7 漏洞概述 字段| 内容 ---|--- 漏洞| cleanupshmrefs 未验证 numparams（理论可达 127，实际受 Linux TEE ioctl...

TEE-reversing

Fundamentos de TEE y conceptos generales Introducción al entorno de ejecución confiable: TrustZone de ARM https://blog.quarkslab.com/introduction-to-trusted-execution-environment-arms-trustzone.html Introducción a TEE título original: TEEを中心とするCPUセキュリティ機能の動向...

CVE-2026-43503

CVE-2026-43503 DirtyClone - PoC - SecurewithUmer PoC de DirtyClone — una vulnerabilidad local de escalada de privilegios en el kernel de Linux. Este repositorio contiene una prueba de concepto funcional que permite a un usuario local sin privilegios obtener privilegios de root explotando la...

CVE-2026-33317

CVE-2026-33317 OP-TEE PKCS11 PoC This repository contains the Normal World proof of concept, reproduction notes, and captured logs for CVE-2026-33317 / GHSA-8cqw-mg7v-c9p9. The official OP-TEE advisory describes missing validation in entrygetattributevalue for PKCS11CMDGETATTRIBUTEVALUE. The bug...

optee-qemu

CVE-2021-44733: Fuzzing y explotación de un use-after-free en el subsistema TEE del kernel de Linux Recientemente se descubrió una vulnerabilidad de use-after-free en el subsistema TEE del kernel de Linux, hasta la versión 5.15.11 inclusive, y se le asignó CVE-2021-44733 1. A primera vista no...

CVE-2019-1010298

CVE-2019-1010298 OP-TEE-2018-0011 Used in the seccamp lecture...

CVE-2018-9411

CVE-2018-9411 CVE-2018-9411 MediaCasService 的利用代码。 请注意，此利用代码仅用于教育或防御目的，不得用于任何恶意或攻击性用途。 关于漏洞和利用的完整文章可在 Zimperium 博客 上获取。 如有任何问题，欢迎在 Twitter 上私信我 @tamirzb。 构建 注意：此利用代码仅适用于特定设备和构建版本 - 搭载 2018 年 5 月安全更新的 Pixel 2 指纹: google/walleye/walleye:8.1.0/OPM2.171019.029.B1/4720900:user/release-keys。 要构建此项目： 1...

The vulnerability of the `register_shm_helper()` function in the `drivers/tee/tee_shm.c` driver for the trusted execution environment of the Linux kernel allows a attacker to cause a service failure.

The vulnerability of the registershmhelper function in the drivers/tee/teeshm.c file of the Linux kernel’s trusted execution environment driver relates to the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker to cause a service...

CVE-2026-80524

A flaw was found in the Linux kernel's OP-TEE Open Portable Trusted Execution Environment Fast Fault-tolerant Architecture FFA component. A local attacker could exploit a missing null check when allocating protected memory. Under specific memory pressure conditions, this could lead to a null...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fixed the kernel panic caused by incorrect error handling. The error path when failing to register devices on the TEE bus contains a bug that leads to kernel panic. The details are as follows: 15.398930 Unable to hand...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tee: added a overflow check in registershmhelper When special lengths are provided by the user space, registershmhelper may cause an integer overflow when calculating the number of pages covered by a given user space memory regio...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: tee: amdtee: fixed an issue where ISERR returned NULL instead of an error pointer. The getfreepages function does not return error pointers; it returns NULL instead. Therefore, this condition needs to be corrected to avoid NUL...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free exists in the drivers/tee/teeshm.c file within the TEE subsystem of the Linux kernel, as of version 5.15.11. This issue arises due to a race condition during the teeshmgetfromid function, when attempting to free a shared memory object...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099790)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099790 advisory. In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a19...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100743)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100743 advisory. In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a19...

CVE-2026-71967

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA opensession handler that allows Normal World clients to cause a denial of service when CFGWIDEVINEPTA is enabled. Attackers can open a session directly on the Widevine PT...