OP-TEE CVE-2026-45614

Exploitation requires that the attacker have local code execution in the normal world (Linux side) with at least low OS-level privileges (PR:L per CVSS vector) and the ability to open a client session to a Trusted Application that exposes ECDH key derivation via TEE_DeriveKey. The target TA must be using one of the affected ECDH shared secret paths and must not perform independent curve point validation before invoking the OP-TEE API. The attack is limited strictly to ECDH derivation operations - other TEE cryptographic functions (signing, encryption) are not directly exploited by this technique. Exploitation is bounded by the AC:H complexity: the attacker must craft ~30-40 mathematically specific invalid curve points and collect sufficient output residues, requiring cryptographic knowledge beyond generic exploitation skill. Remote unauthenticated exploitation is not possible; physical or software access to the normal world execution environment is a hard prerequisite. Deployments where the TA restricts TEE_DeriveKey callers to trusted processes further limit the exploitable attack surface.

The CVSS 4.7 medium score reflects local access (AV:L), high attack complexity (AC:H), and low privileges required (PR:L), but the confidentiality impact is rated High (C:H) - complete private key disclosure. The moderate composite score should not be interpreted as low business impact: full recovery of a TEE-resident private key undermines any trust, attestation, or secure channel reliant on that key, which is the core security promise of TrustZone. The AC:H rating captures the ~30-40 crafted API call requirement, which is non-trivial but well within reach of a cryptographically skilled adversary given documented attack tooling in academic literature. EPSS data was not provided in the input, preventing quantitative exploitation probability assessment. The vulnerability is not listed in CISA KEV and no public POC has been identified, reducing immediate exploitation urgency. However, the local-only attack vector (AV:L) limits internet-scale exploitation to adversaries who have already obtained normal world code execution - a realistic scenario in mobile, IoT, and embedded deployments. Net assessment: medium CVSS score understates cryptographic severity; priority should be elevated for any OP-TEE deployment where ECDH keys protect high-value assets (device identity, attestation, DRM).

An attacker with low-privilege code execution in the Linux normal world of an OP-TEE-equipped device identifies a Trusted Application that performs ECDH key derivation and opens a session to it. The attacker iteratively calls TEE_DeriveKey with approximately 30-40 public keys carefully chosen to lie on small-subgroup curves related to the target ECDH curve, collecting or inferring the resulting shared secret outputs to extract d mod r residues for multiple distinct r values. Applying the Chinese Remainder Theorem to the accumulated residues, the attacker reconstructs the full private key d entirely in the normal world. No public POC has been identified, but the invalid curve attack is a well-established technique described in peer-reviewed cryptographic literature.