We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·Jun 11·5 min read
TrustZone Intermezzo: Broken OP-TEE Memory Isolation on i.MX 8M
TL;DR
A vulnerability existed in OP-TEE, a secure operating system, where its memory could be accessed by the normal world if not properly configured. The team discovered that enabling the TrustZone Address Space Controller (TZASC) on i.MX 8M SoCs was necessary for proper memory protection.
✦ Why It Matters
Engineers must ensure they are using updated OP-TEE versions to maintain memory isolation and protect sensitive data.
Key Takeaways
- Always use OP-TEE versions newer than v4.10.0.
- Enable TZASC for proper memory protection on i.MX 8M.
- Regularly check for security updates and patches.
- Understand the implications of secure vs. normal world access.
Full Summary
OP-TEE operates in the secure world of a System on Chip (SoC), while Linux runs in the normal world, and the TrustZone Address Space Controller (TZASC) is crucial for maintaining this separation. A recent commit in the OP-TEE OS repository ensured that TZASC is enabled on all i.MX 8M SoCs, raising questions about previous memory protection measures.
The team tested various configurations of OP-TEE, focusing on versions prior to v4.10.0 and specific downstream versions. They found that without the correct settings, OP-TEE's memory could be accessed by the normal world, posing a significant security risk.
Their findings highlight the importance of keeping OP-TEE updated and properly configured to safeguard sensitive data. This research is particularly relevant for engineers working with i.MX 8M systems, emphasizing the need for vigilance in security practices.