{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-41325 exists.","fix":"No fix has been published for CVE-2023-41325 yet. Limit exposure of the affected software until one is available.","what":"CVE-2023-41325 is a high-severity use after free vulnerability in OP-TEE optee_os, published on 15 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2023-41325 and fix it if it is affected.\n\nWhat it is: CVE-2023-41325 is a high-severity use after free vulnerability in OP-TEE optee_os, published on 15 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-41325 exists.\n\nAffected product: OP-TEE optee_os. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-41325/ (Markdown: https://insights.sbomify.com/CVE-2023-41325/index.md)","id":"CVE-2023-41325","markdown":"https://insights.sbomify.com/CVE-2023-41325/index.md","name":"CVE-2023-41325","record":{"aliases":["GHSA-jrw7-63cq-7vhm"],"analysis":{"component_type":"operating_system","fix_type":"upgrade","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"OP-TEE Trusted Execution Environment","requires_auth":"high_privilege","summary":"A double free vulnerability in OP-TEE's signature verification allows attackers to potentially execute arbitrary code or escalate privileges within the Trusted Execution Environment.","user_interaction":"required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"op-tee","vendor":"trustedfirmware"}],"cvss":{"score":7.4,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-415","name":"Double Free"}],"description":"OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, `shdr_verify_signature` can make a double free. `shdr_verify_signature` used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (`sw_crypto_acipher_alloc_rsa_public_key`) will try to allocate a memory (which is optee’s heap memory). RSA key is consist of exponent and modulus (represent as variable `e`, `n`) and it allocation is not atomic way, so it may succeed in `e` but fail in `n`. In this case sw_crypto_acipher_alloc_rsa_public_key` will free on `e` and return as it is failed but variable ‘e’ is remained as already freed memory address . `shdr_verify_signature` will free again that memory (which is `e`) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"OP-TEE double free in shdr_verify_signature","id":"CVE-2023-41325","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2023"},"n_packages":0,"n_references":2,"next":{"headline":"Account takeover via Kanban feature in GLPI","id":"CVE-2023-41326"},"packages":[],"prev":{"headline":"Account takeover through API in GLPI","id":"CVE-2023-41324"},"products":["optee_os"],"published":"2023-09-15","related":[{"cvss_score":9.8,"headline":"Memory corruption in OP-TEE","id":"CVE-2019-1010292","kev_date_added":null,"published":"2019-07-16"},{"cvss_score":9.8,"headline":"Memory corruption in OP-TEE","id":"CVE-2019-1010293","kev_date_added":null,"published":"2019-07-15"},{"cvss_score":9.8,"headline":"Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow.","id":"CVE-2019-1010295","kev_date_added":null,"published":"2019-07-15"},{"cvss_score":9.8,"headline":"Memory corruption in OP-TEE","id":"CVE-2019-1010296","kev_date_added":null,"published":"2019-07-15"},{"cvss_score":9.8,"headline":"Memory corruption in OP-TEE","id":"CVE-2019-1010297","kev_date_added":null,"published":"2019-07-15"},{"cvss_score":9.8,"headline":"Memory corruption in OP-TEE","id":"CVE-2019-1010298","kev_date_added":null,"published":"2019-07-15"},{"cvss_score":9.1,"headline":"Information disclosure in n/a","id":"CVE-2019-25052","kev_date_added":null,"published":"2021-08-11"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-09-25","vendors":["OP-TEE"]},"summary":"A double free vulnerability in OP-TEE's signature verification allows attackers to potentially execute arbitrary code or escalate privileges within the Trusted Execution Environment.","url":"https://insights.sbomify.com/CVE-2023-41325/"}