CVE-2023-41325

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-41325
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41325.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-41325
Aliases
  • GHSA-jrw7-63cq-7vhm
Published
2023-09-15T19:40:58.065Z
Modified
2026-04-02T09:20:08.001800Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
OP-TEE double free in shdr_verify_signature
Details

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, shdr_verify_signature can make a double free. shdr_verify_signature used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (sw_crypto_acipher_alloc_rsa_public_key) will try to allocate a memory (which is optee’s heap memory). RSA key is consist of exponent and modulus (represent as variable e, n) and it allocation is not atomic way, so it may succeed in e but fail in n. In this case swcryptoacipherallocrsapublickeywill free oneand return as it is failed but variable ‘e’ is remained as already freed memory address .shdrverifysignaturewill free again that memory (which ise`) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41325.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-415"
    ]
}
References

Affected packages

Git / github.com/op-tee/optee_os

Affected ranges

Type
GIT
Repo
https://github.com/op-tee/optee_os
Events
Introduced
8e74d47616a20eaa23ca692f4bbbf917a236ed94
Fixed
001ace6655dd6bb9cbe31aa31b4ba69746e1a1d9
Database specific 
{
    "versions": [
        {
            "introduced": "3.20"
        },
        {
            "fixed": "3.22"
        }
    ]
}

Affected versions

3.*
3.20.0
3.21.0
3.21.0-rc1
3.22.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41325.json"