OP-TEE Trusted OS 3.20/3.21/3.22 shdr_verify_signature double free

Summaryinfo

A vulnerability was found in OP-TEE Trusted OS 3.20/3.21/3.22. It has been declared as critical. This issue affects the function shdr_verify_signature. The manipulation results in double free. This vulnerability is identified as CVE-2023-41325. The attack is only possible with local access. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in OP-TEE Trusted OS 3.20/3.21/3.22. Affected is the function shdr_verify_signature. The manipulation with an unknown input leads to a double free vulnerability. CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, `shdr_verify_signature` can make a double free. `shdr_verify_signature` used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (`sw_crypto_acipher_alloc_rsa_public_key`) will try to allocate a memory (which is optee’s heap memory). RSA key is consist of exponent and modulus (represent as variable `e`, `n`) and it allocation is not atomic way, so it may succeed in `e` but fail in `n`. In this case sw_crypto_acipher_alloc_rsa_public_key` will free on `e` and return as it is failed but variable ‘e’ is remained as already freed memory address . `shdr_verify_signature` will free again that memory (which is `e`) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available.

The weakness was released 09/16/2023 as GHSA-jrw7-63cq-7vhm. The advisory is available at github.com. This vulnerability is traded as CVE-2023-41325 since 08/28/2023. Technical details are known, but there is no available exploit.

Upgrading to version 3.22 eliminates this vulnerability. Applying the patch e2ec831cb07ed0099535c7c140cb6338aa62816a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• OP-TEE Trusted OS

Version

• 3.20
• 3.21
• 3.22

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion