Integer Overflow in OP-TEE AES-GCM Implementation

Executive Summary

This vulnerability is a 32-bit integer overflow in the AES-GCM implementation of OP-TEE versions 3.0.0 up to before 4.11.0. When processing payloads or Additional Authenticated Data (AAD) larger than 512 megabytes, the length counters overflow due to 32-bit arithmetic limitations. This causes the authentication tag to be computed incorrectly, breaking the authentication guarantee of AES-GCM.

Specifically, the conversion from byte lengths to bit lengths overflows, resulting in incorrect authentication tags and potential tag collisions. Additional overflows occur when processing data exceeding 4 gigabytes. The vulnerability affects systems using the GlobalPlatform TEE Internal Core API or OP-TEE core with Trusted Applications handling large data volumes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by compromising the integrity of data authenticated using AES-GCM within OP-TEE. Because the authentication tag may be computed incorrectly, attackers could potentially cause tag collisions, undermining the trustworthiness of the authentication process.

The impact is limited to local attackers with low complexity and affects only integrity, not confidentiality or availability. However, if your system processes large amounts of data (over 512 MB or 4 GB) within OP-TEE's AES-GCM, this could lead to incorrect authentication results and potential security breaches in trusted applications.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects OP-TEE versions starting from 3.0.0 up to but not including 4.11.0, specifically in the AES-GCM implementation where 32-bit integer overflows occur when processing payloads or Additional Authenticated Data (AAD) exceeding 512 MB.

To detect if your system is vulnerable, you should first verify the OP-TEE version running on your device. If it is between 3.0.0 and 4.10.x, it is potentially affected.

Since the vulnerability involves processing large data volumes with AES-GCM in OP-TEE, detection could involve checking logs or monitoring Trusted Applications (TAs) that handle large payloads or AAD exceeding 512 MB.

Specific commands to check the OP-TEE version might include:

• Check OP-TEE version via kernel messages or OP-TEE OS version files, e.g., `dmesg | grep OP-TEE` or checking version files in the OP-TEE source or build environment.
• Use commands to identify running Trusted Applications and their data processing behavior, though no direct command is provided to detect the overflow condition itself.

No explicit detection commands or network detection methods are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update OP-TEE to version 4.11.0 or later, where the vulnerability has been patched.

The patch fixes the integer overflow by using 64-bit integers for length calculations in the AES-GCM implementation and enforcing strict upper-bound checks according to NIST standards.

No known workarounds are available, so upgrading is the recommended and effective mitigation.

Useful 0 Not Useful 0