Andrej Rosano

Name of the Vulnerable Software and Affected Versions: OPTEE-OS CSU driver for NXP i.MX SoC devices (affected versions not specified) Description: The issue involves a lack of security access configuration in the OPTEE-OS CSU driver for several NXP i.MX SoC device models. This results in a TrustZone bypass, allowing the NonSecure World to perform arbitrary memory read and write operations on Secure World memory. The exploitation of this issue involves a DMA capable peripheral. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Trusted Firmware OP-TEE Trusted OS versions through 3.15.0 Description: An issue in the OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers. This results in TrustZone bypass, allowing the NonSecure World to perform arbitrary memory read/write operations on Secure World memory. The issue involves a v cycle. Recommendations: For versions through 3.15.0, consider disabling the CSU driver for NXP i.MX6UL SoC devices as a temporary workaround until a patch is available. Restrict access to the Secure World memory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is caused by a buffer overflow in the AppleUSBNetworking component, allowing physically proximate attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted USB device.