CVE-2022-46152 OP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs function
A normal-world attacker can exploit an array index validation flaw in OP-TEE to achieve local privilege escalation into the secure world.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-46152?
CVE-2022-46152 is a high-severity memory corruption vulnerability in OP-TEE optee_os, published on 29 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_command()` and `entry_open_session()`. The commands `OPTEE_MSG_CMD_OPEN_SESSION` and `OPTEE_MSG_CMD_INVOKE_COMMAND` can be executed from the normal world via an OP-TEE SMC. This function is not validating the `num_params` argument, which is only limited to `OPTEE_MSG_MAX_NUM_PARAMS` (127) in the function `get_cmd_buffer()`. Therefore, an attacker in the normal world can craft an SMC call that will cause out-of-bounds reading in `cleanup_shm_refs` and potentially freeing of fake-objects in the function `mobj_put()`. A normal-world attacker with permission to execute SMC instructions may exploit this flaw. Maintainers believe this problem permits local privilege escalation from the normal world to the secure world. Version 3.19.0 contains a fix for this issue. There are no known workarounds.
Weakness: CWE-129
Which versions are affected by CVE-2022-46152?
It affects 1 product.
Products include Trustedfirmware Op-Tee.
How do I fix CVE-2022-46152?
No fix has been published for CVE-2022-46152 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-46152 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-46152 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in OP-TEE optee_os
Sources
Also known as GHSA-65w8-6mrg-52g7.