CVE-2026-45329: ESF-IDF: Out-of-Bounds Read in ESP-TEE Secure Service Wrappers

Synopsis

An out-of-bounds read vulnerability affects ESP-IDF versions 5.5.4 and 6.0, specifically in the ESP-TEE secure-service wrapper functions in esp_secure_services.c and esp_secure_services_iram.c. Because the TEE-protected hardware peripherals (ECC, SHA, SPI) operate in RISC-V machine mode with full address-space access, a local caller can supply attacker-controlled pointers into TEE-exclusive memory, causing those peripherals to read and return data derived from protected memory regions. Successful exploitation enables disclosure of sensitive TEE-resident secrets such as cryptographic keys or other protected data. A patched-image rebuild at versions 5.5.5 and 6.0.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required to reach the vulnerable wrappers.

• AuthenticationNot required

  No account credentials or privilege level are required to call the ESP-TEE secure-service wrappers from the REE (Rich Execution Environment) side.

• Victim interactionNot required

  Exploitation is fully attacker-driven and does not require any action from another user or process.

• Attack complexityDetail

  The exploit is reliable and condition-free at low complexity, though extracting full secrets via the single-bit oracle path requires repeated calls; no race conditions or memory-layout dependencies are involved.

Blast Radius

• Reads raw bytes from TEE-exclusive memory regions, which may include private ECC keys, SHA intermediate state, or SPI-protected secrets.
• Reconstructs full secret values incrementally through repeated wrapper calls that expose computed functions of TEE memory.
• Uses the single-bit oracle path to perform bit-by-bit disclosure of TEE-resident sensitive data over a series of calls.
• No integrity or availability impact: the host filesystem, peripheral configuration, and service uptime are unaffected by this exploit path.