CVE-2023-41325 OP-TEE double free in shdr_verify_signature
A double free vulnerability in OP-TEE's signature verification allows attackers to potentially execute arbitrary code or escalate privileges within the Trusted Execution Environment.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-41325?
CVE-2023-41325 is a high-severity use after free vulnerability in OP-TEE optee_os, published on 15 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, `shdr_verify_signature` can make a double free. `shdr_verify_signature` used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (`sw_crypto_acipher_alloc_rsa_public_key`) will try to allocate a memory (which is optee’s heap memory). RSA key is consist of exponent and modulus (represent as variable `e`, `n`) and it allocation is not atomic way, so it may succeed in `e` but fail in `n`. In this case sw_crypto_acipher_alloc_rsa_public_key` will free on `e` and return as it is failed but variable ‘e’ is remained as already freed memory address . `shdr_verify_signature` will free again that memory (which is `e`) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available.
Weakness: CWE-415
Which versions are affected by CVE-2023-41325?
It affects 1 product.
Products include Trustedfirmware Op-Tee.
How do I fix CVE-2023-41325?
No fix has been published for CVE-2023-41325 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-41325 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-41325 exists.
Other vulnerabilities in OP-TEE optee_os
Sources
Also known as GHSA-jrw7-63cq-7vhm.