Panic Vulnerability in OP-TEE Security Platform Affecting Arm Cortex-A Architecture

CVE-2025-46733

What is CVE-2025-46733?

The OP-TEE platform, a Trusted Execution Environment (TEE), has a vulnerability that allows an attacker to exploit the Secure Storage API through a malicious tee-supplicant binary in the REE userspace. By manipulating unexpected return codes from secure storage operations, an attacker can trigger a panic in a Trusted Application (TA). This vulnerability poses significant risks, especially in TAs like the fTPM, which rely on preserved memory states. Such a situation can lead to denial of service or potentially serious data exposure, as attackers could reset and manipulate important platform configuration registers (PCRs), compromising sensitive data integrity and security measures.

References