Trustfall: An RSA Heap Underwrite Into OP-TEE's Secure World
Three vulnerabilities in OP-TEE, the TrustZone TEE that guards keys and secure storage on many Arm devices. Two of them open a path to code execution at S-EL1 (the highest privilege level on TrustZone).