CVE-2021-36133

Publication date 7 December 2021

Last updated 7 August 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.1 · High

Score breakdown

The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a DMA capable peripheral.

Status

Package Ubuntu Release Status
optee-os 24.10 oracular
Needs evaluation
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
20.04 LTS focal Not in release

Severity score breakdown

Parameter Value
Base score 7.1 · High
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact None
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N