How would this be patched? I'm assuming that this will require ucode/hardware patching as trustzone is implemented in hardware?
With TrustZone, some code is running in the secure domain and can read or write to both secure and non-secure memory. You need to find some bug in the secure code to "trick" the secure code into copying data from secure memory to non-secure memory.