cve-2016-2431

cve-2016-2431 Qualcomm TrustZone kernel privilege escalation...

PoC_CVE-2025-48507

Breaking TrustZone on Zynq UltraScale+ MPSoCs - Proof of Concept for CVE-2025-48507 and CVE-2025-0038 Non-Secure Software could exploit CVE-2025-48507 and CVE-2025-0038 to gain read/write access to Secure World on Zynq UltraScale+ platforms , thereby breaking TrustZone isolation. To that extent,...

cachegrab

Cachegrab Cachegrab is a tool designed to help perform and visualize trace-driven cache attacks against software in the secure world of TrustZone-enabled ARMv8 cores. For an overview of how Cachegrab works under the hood, see the Cachegrab release announcement. Using Cachegrab on Android It is...

GoTEE

Introduction The GoTEE framework implements concurrent instantiation of TamaGo based unikernels in privileged and unprivileged modes, interacting with each other through monitor mode and custom system calls. With these capabilities GoTEE implements a TamaGo based Trusted Execution Environments TE...

TEE-reversing

TEE Basics & General Introduction to Trusted Execution Environment: ARM's TrustZone https://blog.quarkslab.com/introduction-to-trusted-execution-environment-arms-trustzone.html Introduction to TEE original title: TEEを中心とするCPUセキュリティ機能の動向...

Lenovo-Qcom-RPMB-PoC

Lenovo Qcom RPMB Tool !CAUTION Prerequisites : Python 3.12 64-bit must be installed on your Windows system and added to PATH before running this tool. The bundled offline dependencies and Qualcomm EDL communication rely on Python 3.12. !IMPORTANT Device Compatibility Notice : This tool is strictl...

GoTEE-example

Introduction The GoTEE framework implements concurrent instantiation of TamaGo based unikernels in privileged and unprivileged modes, interacting with each other through monitor mode and custom system calls. With these capabilities GoTEE implements a TamaGo based Trusted Execution Environments TE...

EUVD-2026-118540

Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples trustzoneexamples, affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channe...

CVE-2026-118785

Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples trustzoneexamples, affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channe...

CVE-2026-118785 NXP MCUXpresso SDK TrustZone-M Examples before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions

Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples trustzoneexamples, affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channe...

CVE-2026-118785

Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples trustzoneexamples, affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channe...

CVE-2026-118785 NXP MCUXpresso SDK TrustZone-M Examples before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions

Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples trustzoneexamples, affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channe...

Protecting CPU AI on Edge TEEs: WebAssembly's Promise and Practical Challenges

AI models on edge hardware contain important intellectual property IP, but an adversary can steal it when they achieve root access. Trusted Execution Environments TEE like Arm TrustZone protect against these Operating System OS level attacks. However, they are challenging to use. More precisely, ...

UBUNTU-CVE-2026-98313

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

CVE-2026-102709

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware...

CVE-2026-102709

An improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker in the non-secure world to provide pointers to secure memory. The secure firmware fails to verify these pointers before dereferencing them, leading to unintended...

EUVD-2026-89172

Improper validation of non-secure NS pointers in multiple TrustZone-M non-secure callable NSC entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifyin...

CVE-2026-102709

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware...

CVE-2026-102709

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware...

CVE-2026-102709

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware...