CVE catalog

CVE-2021-36133

DEBIAN-CVE-2021-36133

Severity: Unknown
Published: Dec 7, 2021, 9:15:08 PM UTC
Updated: Sep 1, 2026, 8:04:30 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.27% · Oct 25, 2026

The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a DMA capable peripheral.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	optee-os	13	`4.10.0-1`	vulnerable
Debian	optee-os	13	`4.10.0-2`	vulnerable
Debian	optee-os	13	`4.5.0-2`	vulnerable
Debian	optee-os	13	`4.7.0-1`	vulnerable
Debian	optee-os	13	`4.8.0-1`	vulnerable
Debian	optee-os	13	`4.9.0-1`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 13 (Trixie)]

[optee-os]Affected
Details (1)
- 4.5.0-2 · arm64 · trixie
  Affected
  pypi · optee-os · debian · 13
[optee-os-dev]Affected
Source package: [optee-os]
Details (1)
- 4.5.0-2 · arm64 · trixie
  Affected
  pypi · optee-os · debian · 13

Observed: Oct 23, 2026, 5:58:43 PM UTC

References

[https://osv.dev/vulnerability/DEBIAN-CVE-2021-36133]

[FIRST EPSS] · [OSV Package Vulnerability Database]