Jens Wiklander

**Name of the Vulnerable Software and Affected Versions** OP-TEE versions 3.9.0 through 4.10.x **Description** The RSA-OAEP decryption implementation in the NXP CAAM crypto driver uses a non-constant-time `memcmp()` function for label hash verification and contains multiple distinguishable error paths. This creates a Manger-style padding oracle, which is a side-channel attack that allows an attacker to recover RSA-OAEP plaintext by sending approximately 1000-2000 adaptive chosen ciphertext queries. **Recommendations** Update to version 4.11.0. Disable the NXP CAAM RSA driver by setting `CFG CRYPTO DRV RSA=n`.

**Name of the Vulnerable Software and Affected Versions** OP-TEE versions 3.0.0 through 4.10.x **Description** OP-TEE is a Trusted Execution Environment (TEE) designed as a companion to a non-secure Linux kernel running on Arm Cortex-A cores using TrustZone technology. A 32-bit integer overflow exists in the AES-GCM implementation of the OP-TEE core. This issue occurs when processing more than 512 megabytes of payload or Additional Authenticated Data (AAD), causing the authentication tag to be computed with incorrect bit-length values and breaking the authentication guarantee. **Recommendations** Update to version 4.11.0.