CVE-2026-33317

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-33317

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33317.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-33317

Aliases

GHSA-8cqw-mg7v-c9p9

Downstream

Published

2026-04-24T02:20:55Z

Modified

2026-10-28T10:49:27Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L CVSS Calculator

Summary

OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure

Details

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in entry_get_attribute_value() in ta/pkcs11/src/object.c can lead to out-of-bounds read from the PKCS#11 TA heap or a crash. When chained with the OOB read, the PKCS#11 TA function PKCS11_CMD_GET_ATTRIBUTE_VALUE or entry_get_attribute_value() can, with a bad template parameter, be tricked into reading at most 7 bytes beyond the end of the template buffer and writing beyond the end of the template buffer with the content of an attribute value of a PKCS#11 object. Commits e031c4e562023fd9f199e39fd2e85797e4cbdca9, 16926d5a46934c46e6656246b4fc18385a246900, and 149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca contain patches and are anticipated to be part of version 4.11.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125",
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33317.json"
}

References

Affected packages

Git / github.com/op-tee/optee_os

Affected ranges

Type

GIT

Repo

https://github.com/op-tee/optee_os

Events

Introduced

30c13f9e2ff178c9a299e409de75d50529cf5064

Fixed

149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca

Fixed

16926d5a46934c46e6656246b4fc18385a246900

Fixed

e031c4e562023fd9f199e39fd2e85797e4cbdca9

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.13.0"
                },
                {
                    "last_affected":  "4.10.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "16926d5a46934c46e6656246b4fc18385a246900"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "e031c4e562023fd9f199e39fd2e85797e4cbdca9"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*

3.13.0

3.14.0

3.14.0-rc1

3.15.0

3.15.0-rc1

3.16.0

3.17.0

3.17.0-rc1

3.18.0

3.18.0-rc1

3.19.0

3.19.0-rc1

3.20.0

3.20.0-rc1

3.21.0

3.21.0-rc1

3.22.0

3.22.0-rc1

4.*

4.0.0

4.0.0-rc1

4.1.0

4.1.0-rc1

4.10.0

4.10.0-rc1

4.2.0

4.2.0-rc1

4.3.0

4.3.0-rc1

4.4.0

4.4.0-rc1

4.5.0

4.5.0-rc1

4.6.0

4.6.0-rc1

4.7.0

4.7.0-rc1

4.8.0

4.8.0-rc1

4.9.0

4.9.0-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33317.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "168297327031639610175545632599267655465",
                "58618673472695113818148772623005608170",
                "22653532609792172783243611151621494955",
                "245427264851391875345365851580315751769",
                "161019481948545099294855895815300608163",
                "92888549139230552028421373795086379427"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-33317-039bbde2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/op-tee/optee_os/commit/e031c4e562023fd9f199e39fd2e85797e4cbdca9",
        "target":  {
            "file":  "ta/pkcs11/src/object.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "188761443579505564083716449668100106201",
            "length":  3206
        },
        "id":  "CVE-2026-33317-0be2b154",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/op-tee/optee_os/commit/149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca",
        "target":  {
            "file":  "ta/pkcs11/src/object.c",
            "function":  "entry_get_attribute_value"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "8521176463211282021672805402815570965",
            "length":  2771
        },
        "id":  "CVE-2026-33317-b6e3bb8a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/op-tee/optee_os/commit/e031c4e562023fd9f199e39fd2e85797e4cbdca9",
        "target":  {
            "file":  "ta/pkcs11/src/object.c",
            "function":  "entry_get_attribute_value"
        }
    }
]

vanir_signatures_modified

"2026-10-28T10:49:27Z"