OP‑TEE OS includes the NXP CAAM crypto driver for RSA‑OAEP decryption. The driver uses a normal, non‑constant‑time memcmp() to compare the expected label hash with the supplied one and terminates with distinct error messages for each failure scenario. This combination creates a Manager‑style padding oracle that leaks information about the label hash. An attacker who can supply chosen ciphertexts and observe the differing error responses can recover the original RSA‑OAEP plaintext after approximately 1 000–2 000 adaptive queries, thereby exposing sensitive data that was presumed protected by asymmetric encryption. This weakness is classified as CWE‑208, Information Exposure Through an Improperly Controlled Exception. Based on the description, it is inferred that the attacker requires the ability to execute the RSA‑OAEP routine inside the trusted environment and to read the resulting error codes or status values.

All releases of OP‑TEE OS from 3.9.0 through 4.10.x are affected when the NXP CAAM RSA driver is enabled (CFG_CRYPTO_DRV_RSA=y). The patch was introduced in version 4.11.0. Builds that disable the driver (CFG_CRYPTO_DRV_RSA=n) are not impacted.

The CVSS score of 2.5 reflects low overall severity, mainly because the vulnerability is limited enabled. The EPSS score of < 1 indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; the attacker must have the capability to interact with the NXP CAAM driver—most plausibly through the non‑secure operating system or through a privileged local user—and must be able to observe the distinct error responses. Based on the description, it is inferred that remote exploitation would require an additional world that can trigger the trusted execution environment to process chosen ciphertexts.