In the Linux kernel, the following vulnerability has been resolved:
tee: amdtee: fix use-after-free vulnerability in amdteeclosesession
There is a potential race condition in amdteeclosesession that may cause use-after-free in amdteeopensession. For instance, if a session has refcount == 1, and one thread tries to free this session via:
kref_put(&sess->refcount, destroy_session);
the reference count will get decremented, and the next step would be to call destroysession(). However, if in another thread, amdteeopensession() is called before destroysession() has completed execution, allocsession() may return 'sess' that will be freed up later in destroysession() leading to use-after-free in amdteeopensession.
To fix this issue, treat decrement of sess->refcount and removal of 'sess' from session list in destroy_session() as a critical section, so that it is executed atomically.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "145278395822626077055716000599181191036",
"length": 605.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "amdtee_close_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-01ee7188",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c95574350cd63bc3c5c2fa06658010768f2a0ce"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "145278395822626077055716000599181191036",
"length": 605.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "amdtee_close_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-097c6409",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4384b3e54ea813868bb81a861bf5b2406e15d8f"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"126360496815748074991875637442517395469",
"253490829958995023100811263539942207989",
"23714925617890453664348902909621939880",
"38230623563257638985069494508959141214",
"599541727803809079680550764699877688",
"78805085082891610866523156196358912253",
"336808753349013669575154333729930327771",
"324125541501973268756000020509631636716",
"206637800752862402420933251241517676800",
"150283683559160213392422850258429263011",
"306965621123553803348986192984644023168",
"157761188452261011663823526265053108071",
"228578090613279868595506079430401994231",
"201962529266429478078704296088364336160",
"88127089899232815805723312010976177544",
"234497171285487369991596629068613293992",
"180198931717923440026921430990351585748",
"230841935279462218315908053173888805164",
"317399574975003656081017500208970362355",
"176087735646612783586932496116934280076"
]
},
"target": {
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"id": "CVE-2023-52503-0b6346e1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1680c82929bc14d706065f123dab77f2f1293116"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "104334254963605066943838960128668039320",
"length": 1515.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "amdtee_open_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-449250b9",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da7ce52a2f6c468946195b116615297d3d113a27"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "257757268887742279836080828042420926197",
"length": 261.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "destroy_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-49a8a860",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1680c82929bc14d706065f123dab77f2f1293116"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "257757268887742279836080828042420926197",
"length": 261.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "destroy_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-4cfa9ce7",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c3e7a00db954947c265b55099c21b216f2a05c"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"126360496815748074991875637442517395469",
"253490829958995023100811263539942207989",
"23714925617890453664348902909621939880",
"38230623563257638985069494508959141214",
"599541727803809079680550764699877688",
"78805085082891610866523156196358912253",
"336808753349013669575154333729930327771",
"324125541501973268756000020509631636716",
"206637800752862402420933251241517676800",
"150283683559160213392422850258429263011",
"306965621123553803348986192984644023168",
"157761188452261011663823526265053108071",
"228578090613279868595506079430401994231",
"201962529266429478078704296088364336160",
"88127089899232815805723312010976177544",
"234497171285487369991596629068613293992",
"180198931717923440026921430990351585748",
"230841935279462218315908053173888805164",
"317399574975003656081017500208970362355",
"176087735646612783586932496116934280076"
]
},
"target": {
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"id": "CVE-2023-52503-663ed73c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c3e7a00db954947c265b55099c21b216f2a05c"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "257757268887742279836080828042420926197",
"length": 261.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "destroy_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-6fa00d8e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4384b3e54ea813868bb81a861bf5b2406e15d8f"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "145278395822626077055716000599181191036",
"length": 605.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "amdtee_close_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-7ab70e33",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c3e7a00db954947c265b55099c21b216f2a05c"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "145278395822626077055716000599181191036",
"length": 605.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "amdtee_close_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-85e68e6b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1680c82929bc14d706065f123dab77f2f1293116"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "104334254963605066943838960128668039320",
"length": 1515.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "amdtee_open_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-95eed589",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c3e7a00db954947c265b55099c21b216f2a05c"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "104334254963605066943838960128668039320",
"length": 1515.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "amdtee_open_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-a9fb04ab",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c95574350cd63bc3c5c2fa06658010768f2a0ce"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"126360496815748074991875637442517395469",
"253490829958995023100811263539942207989",
"23714925617890453664348902909621939880",
"38230623563257638985069494508959141214",
"599541727803809079680550764699877688",
"78805085082891610866523156196358912253",
"336808753349013669575154333729930327771",
"324125541501973268756000020509631636716",
"206637800752862402420933251241517676800",
"150283683559160213392422850258429263011",
"306965621123553803348986192984644023168",
"157761188452261011663823526265053108071",
"228578090613279868595506079430401994231",
"201962529266429478078704296088364336160",
"88127089899232815805723312010976177544",
"234497171285487369991596629068613293992",
"180198931717923440026921430990351585748",
"230841935279462218315908053173888805164",
"317399574975003656081017500208970362355",
"176087735646612783586932496116934280076"
]
},
"target": {
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"id": "CVE-2023-52503-aad981b4",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da7ce52a2f6c468946195b116615297d3d113a27"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "104334254963605066943838960128668039320",
"length": 1515.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "amdtee_open_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-ad866bf4",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4384b3e54ea813868bb81a861bf5b2406e15d8f"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "257757268887742279836080828042420926197",
"length": 261.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "destroy_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-bd16679e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da7ce52a2f6c468946195b116615297d3d113a27"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "104334254963605066943838960128668039320",
"length": 1515.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "amdtee_open_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-bfd5619b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1680c82929bc14d706065f123dab77f2f1293116"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "145278395822626077055716000599181191036",
"length": 605.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "amdtee_close_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-d965517b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da7ce52a2f6c468946195b116615297d3d113a27"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "257757268887742279836080828042420926197",
"length": 261.0
},
"target": {
"file": "drivers/tee/amdtee/core.c",
"function": "destroy_session"
},
"signature_version": "v1",
"id": "CVE-2023-52503-df4591a9",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c95574350cd63bc3c5c2fa06658010768f2a0ce"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"126360496815748074991875637442517395469",
"253490829958995023100811263539942207989",
"23714925617890453664348902909621939880",
"38230623563257638985069494508959141214",
"599541727803809079680550764699877688",
"78805085082891610866523156196358912253",
"336808753349013669575154333729930327771",
"324125541501973268756000020509631636716",
"206637800752862402420933251241517676800",
"150283683559160213392422850258429263011",
"306965621123553803348986192984644023168",
"157761188452261011663823526265053108071",
"228578090613279868595506079430401994231",
"201962529266429478078704296088364336160",
"88127089899232815805723312010976177544",
"234497171285487369991596629068613293992",
"180198931717923440026921430990351585748",
"230841935279462218315908053173888805164",
"317399574975003656081017500208970362355",
"176087735646612783586932496116934280076"
]
},
"target": {
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"id": "CVE-2023-52503-f01e95c6",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c95574350cd63bc3c5c2fa06658010768f2a0ce"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"126360496815748074991875637442517395469",
"253490829958995023100811263539942207989",
"23714925617890453664348902909621939880",
"38230623563257638985069494508959141214",
"599541727803809079680550764699877688",
"78805085082891610866523156196358912253",
"336808753349013669575154333729930327771",
"324125541501973268756000020509631636716",
"206637800752862402420933251241517676800",
"150283683559160213392422850258429263011",
"306965621123553803348986192984644023168",
"157761188452261011663823526265053108071",
"228578090613279868595506079430401994231",
"201962529266429478078704296088364336160",
"88127089899232815805723312010976177544",
"234497171285487369991596629068613293992",
"180198931717923440026921430990351585748",
"230841935279462218315908053173888805164",
"317399574975003656081017500208970362355",
"176087735646612783586932496116934280076"
]
},
"target": {
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"id": "CVE-2023-52503-fc9b723a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4384b3e54ea813868bb81a861bf5b2406e15d8f"
}
]