CVE-2019-25052 - In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information

Back Back to CVE browser

CRITICAL

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information

Published Aug 11, 2021

9.1

CRITICAL

CVSS 3.1

EPSS 0.87%

Description

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-327

Broken Crypto Algorithm

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11501
Advisory
https://github.com/OP-TEE/optee_os/commit/34a08bec755670ea0490cb53bbc68058cafc69b6
x_refsource_MISCPatchThird Party Advisory
https://github.com/OP-TEE/optee_os/security/advisories/GHSA-pgwr-qmgh-vhmf
x_refsource_MISCPatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11501		Advisory
https://github.com/OP-TEE/optee_os/commit/34a08bec755670ea0490cb53bbc68058cafc69b6		x_refsource_MISCPatchThird Party Advisory
https://github.com/OP-TEE/optee_os/security/advisories/GHSA-pgwr-qmgh-vhmf		x_refsource_MISCPatchThird Party Advisory