Patch Ticker

ESP-IDF unvalidated stack pointer breaks TEE isolation on ESP32 chips

ESP32 device's secure area can be breached, corrupting its control data!

Summary

Espressif's ESP-IDF IoT development framework does not validate a stack pointer at the ESP-TEE privilege-switch boundary, so a local unprivileged application can write into TEE-exclusive memory. ESP32-C5, ESP32-C6, ESP32-C61 and ESP32-H2 devices are affected.

Affected when

  • ESP32-C5, ESP32-C6, ESP32-C61 or ESP32-H2 devices
  • A local unprivileged REE application running on the device
  • ESP-IDF 5.5.5 until 5.5.6, 6.0.4 and 6.1.1 versions

What to do

Update to ESP-IDF 5.5.6. Versions 6.0.4 and 6.1.1 are scheduled fixes, so update once they are released.

Update to at least the version for your product:

  • ESP-IDF 5.5 5.5.6 or later
  • ESP-IDF 6.0 6.0.4 or later
  • ESP-IDF 6.1 6.1.1 or later

Products and platforms

  • esp-idf

CVE IDs

Times

First published

First seen