CVE-2021-44149

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a v cycle.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/OP-TEE/optee_os/tagsRelease Notes, Third Party Advisory
https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0002-OP-TEE_TrustZone_bypass_at_wakeup.txtThird Party Advisory
https://github.com/OP-TEE/optee_os/tagsRelease Notes, Third Party Advisory
https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0002-OP-TEE_TrustZone_bypass_at_wakeup.txtThird Party Advisory

Timeline

Published: Dec 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-44154.3The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is du CVE-2021-441507.5The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content.CVE-2021-441517.5An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing CVE-2021-441529.8An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an una CVE-2021-441537.2An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable an option to run arbi CVE-2021-441547.2An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit_opt, which will then CVE-2021-441555.3An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is vali CVE-2021-441588.0ASUS RT-AX56U Wi-Fi Router is vulnerable to stack-based buffer overflow due to improper validation for httpd parameter length. An authentica CVE-2021-441599.84MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshel CVE-2021-44164.3The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing CVE-2021-441607.3Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s pr CVE-2021-441618.8Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input. A attacker in loca