Two out-of-bounds writes in Unisoc's tee service can crash it. Unisoc lists the T606 as affected. OhrTech devices were never vulnerable: we replaced Unisoc's TEE and its services with Trusty.
What the vulnerability is
Unisoc's "tee service" is missing a bounds check in two places, allowing out-of-bounds writes. Unisoc describes the impact as local denial of service, with System execution privileges needed; CISA rates them 4.4 (Medium). Its affected list includes the T606, T612 and T616, and it fixed both in its May 2023 security bulletin.
Why OhrTech devices were never vulnerable
The Trusted Execution Environment (TEE) is the isolated, secure-world operating system that holds keys and runs trusted code apart from Android. On these chips, Unisoc ships its own modified version of Google's Trusty, with its own trusted apps and the Android services that talk to them.
The Foundation OS does not use any of it. We replaced Unisoc's TEE and its services with the reference Trusty from the Android Open Source Project, so the affected Unisoc code has never been part of the software on an OhrTech device.
Who needs to act
Nobody.
Credit
Unisoc disclosed both flaws in its May 2023 security bulletin and did not name who found them.
Timeline
- Unisoc publishes both CVEs in its May 2023 security bulletin.
- OhrTech confirms its devices are not affected.