Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-1010292: OP-TEE before v3.4.0 can corrupt memory
CVE-2019-1010292 · published 7 years ago
Summary
The OP-TEE trusted‑execution environment version earlier than 3.4.0 may allow software running inside it to overwrite any memory it can reach. This could cause instability or data loss for applications that rely on the trusted area. Updating OP-TEE to version 3.4.0 or later resolves the issue.
What to do
- Update trustedfirmware op-tee to version 3.4.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| trustedfirmware | op-tee |
< 3.4.0 cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* |
Original advisory text
Linaro/OP-TEE OP-TEE Prior to version v3.4.0 is affected by: Boundary checks. The impact is: This could lead to corruption of any memory which the TA can access. The component is: optee_os. The fix...
Linaro/OP-TEE OP-TEE Prior to version v3.4.0 is affected by: Boundary checks. The impact is: This could lead to corruption of any memory which the TA can access. The component is: optee_os. The fixed version is: v3.4.0.
References
- https://github.com/OP-TEE/optee_os/commit/e3adcf566cb278444830e7badfdcc3983e334f... Patch Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-787Out-of-bounds Write
Timeline
Published16 Jul 2019
Updated1 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-1010292 · NVD
Track software like this
Free during beta