Vulnerability Details CVE-2019-25052
In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.009
EPSS Ranking 54.2%
CVSS Severity
CVSS v3 Score 9.1
CVSS v2 Score 6.4
References
- https://github.com/OP-TEE/optee_os/commit/34a08bec755670ea0490cb53bbc68058cafc69b6
- https://github.com/OP-TEE/optee_os/security/advisories/GHSA-pgwr-qmgh-vhmf
- https://github.com/OP-TEE/optee_os/commit/34a08bec755670ea0490cb53bbc68058cafc69b6
- https://github.com/OP-TEE/optee_os/security/advisories/GHSA-pgwr-qmgh-vhmf
Products affected by CVE-2019-25052
-
cpe:2.3:o:trustedfirmware:op-tee:-
-
cpe:2.3:o:trustedfirmware:op-tee:0.1.0
-
cpe:2.3:o:trustedfirmware:op-tee:0.2.0
-
cpe:2.3:o:trustedfirmware:op-tee:0.3.0
-
cpe:2.3:o:trustedfirmware:op-tee:1.0.0
-
cpe:2.3:o:trustedfirmware:op-tee:1.0.1
-
cpe:2.3:o:trustedfirmware:op-tee:1.1.0
-
cpe:2.3:o:trustedfirmware:op-tee:2.0.0
-
cpe:2.3:o:trustedfirmware:op-tee:2.1.0
-
cpe:2.3:o:trustedfirmware:op-tee:2.2.0
-
cpe:2.3:o:trustedfirmware:op-tee:2.3.0
-
cpe:2.3:o:trustedfirmware:op-tee:2.4.0
-
cpe:2.3:o:trustedfirmware:op-tee:2.5.0
-
cpe:2.3:o:trustedfirmware:op-tee:2.6.0
-
cpe:2.3:o:trustedfirmware:op-tee:3.0.0
-
cpe:2.3:o:trustedfirmware:op-tee:3.1.0
-
cpe:2.3:o:trustedfirmware:op-tee:3.2.0
-
cpe:2.3:o:trustedfirmware:op-tee:3.3.0
-
cpe:2.3:o:trustedfirmware:op-tee:3.4.0
-
cpe:2.3:o:trustedfirmware:op-tee:3.5.0
-
cpe:2.3:o:trustedfirmware:op-tee:3.6.0