Vulnerability · Published Dec 7, 2021 · Assigned by mitre
CVE-2021-36133
High 7.1
In plain English
A high-severity security flaw in the optee-os package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS NVD)7.1High
Exploit odds (30 days)0.3%top 80.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a DMA capable peripheral.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | optee-os | no fix listed | DEBIAN-CVE-2021-36133 |
| Ubuntu:25.10 | optee-os | no fix listed | UBUNTU-CVE-2021-36133 |
| Ubuntu:26.04:LTS | optee-os | no fix listed | UBUNTU-CVE-2021-36133 |
| Ubuntu:26.10 | optee-os | no fix listed | UBUNTU-CVE-2021-36133 |