CVE-2021-36133

Published: Dec 7, 2021Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 1.8 / Impact: 5.2

Source: NVD

Description

The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a DMA capable peripheral.

Affected (1)

Products: Trustedfirmware: Op Tee

Trustedfirmware

1 product

Configuration A

1 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Trustedfirmware Op Tee	All versions

Running on/with	Platform Versions
Nxp I.mx6sx	All versions
Nxp I.mx 6	All versions
Nxp I.mx 6solox	All versions
Nxp I.mx 6ull	All versions
Nxp I.mx 6ulz	All versions
Nxp I.mx 7ds	All versions

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0001-OP-TEE_TrustZone_bypass.txt

Source: cve@mitre.org

Third Party Advisory

https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0001-OP-TEE_TrustZone_bypass.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.