A stack buffer overflow in the DRM trustlet of Unisoc's TrustZone software allows code execution inside the TEE. Unisoc lists the T606 as affected. OhrTech devices were never vulnerable: they do not run Unisoc's TEE.
What the vulnerability is
Unisoc's TEE includes a trusted app for cryptography used by DRM: a Widevine interface plus Unisoc's own OEMCrypto API. Laszlo Szapula of TASZK Security Labs found that one of its commands copies a sender-supplied number of bytes onto a fixed-size stack buffer without checking the size, and the trustlet has no stack protection. A program able to talk to the trustlet can overflow the buffer and run code inside the TEE. Read TASZK's advisory.
Unisoc lists the T606, T612, T616, T610, T618, T760, T770, T820 and S8000 as affected, and fixed it in its August 2023 security bulletin. NVD rates it 7.2 (High).
Why OhrTech devices were never vulnerable
The Trusted Execution Environment (TEE) is the isolated, secure-world operating system that holds keys and runs trusted code apart from Android. On these chips, Unisoc ships its own modified version of Google's Trusty, with its own trusted apps and the Android services that talk to them.
The Foundation OS does not use any of it. We replaced Unisoc's TEE and its services with the reference Trusty from the Android Open Source Project, so the affected Unisoc code has never been part of the software on an OhrTech device.
Who needs to act
Nobody.
Credit
Found by Laszlo Szapula of TASZK Security Labs, who reported it to Unisoc in May 2022 and published a detailed advisory. Thank you.
Timeline
- TASZK Security Labs reports the flaw to Unisoc PSIRT.
- Unisoc publishes CVE-2023-33913 in its August 2023 security bulletin.
- TASZK Security Labs publishes its technical advisory.
- OhrTech confirms its devices are not affected.