In the Linux kernel, the following vulnerability has been resolved:
tee: amdtee: fix race condition in amdteeopensession
There is a potential race condition in amdteeopensession that may lead to use-after-free. For instance, in amdteeopensession() after sess->sess_mask is set, and before setting:
sess->session_info[i] = session_info;
if amdteeclosesession() closes this same session, then 'sess' data structure will be released, causing kernel panic when 'sess' is accessed within amdteeopensession().
The solution is to set the bit sess->sessmask as the last step in amdteeopen_session().
[
{
"signature_type": "Line",
"target": {
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175581571935192748567870035046157423372",
"282574088253263344698449051546636538137",
"251107346330102061567098977912959259706",
"112204422900868273924117189455260367907",
"36708798478795505531247412214475860252",
"129203586056436310470659607378338121248",
"45658863773442858730104250121527472453",
"311420911181726005132766416086339954177",
"317921175549826955713042585436643035096",
"98402905945440095821459055949880369155",
"88127089899232815805723312010976177544",
"234497171285487369991596629068613293992",
"322308539855900533795957184613951165572",
"282502598271291900225035900305483981290",
"114354123851922950074908240543259669368",
"206490189613942204668194824487839784526",
"215708491005139994277683916560916529583",
"142270628692712362970476711164749353055",
"316985830661747751626061665199483704726",
"44842425417822073122656877622450034998",
"245302777864795696911730949505920772679",
"306965621123553803348986192984644023168",
"189911751770306836562635028865841488377",
"59428087873651469876124700355287767586",
"248685273619588218182138358773371968806",
"74964792076202426878510906725272040332",
"284421031296372231674610905504071987126"
]
},
"deprecated": false,
"id": "CVE-2023-53047-2f53ec21",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f632a90f8e39db39b322107b9a8d438b826a7f4f"
},
{
"signature_type": "Line",
"target": {
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175581571935192748567870035046157423372",
"282574088253263344698449051546636538137",
"251107346330102061567098977912959259706",
"112204422900868273924117189455260367907",
"36708798478795505531247412214475860252",
"129203586056436310470659607378338121248",
"45658863773442858730104250121527472453",
"311420911181726005132766416086339954177",
"317921175549826955713042585436643035096",
"98402905945440095821459055949880369155",
"88127089899232815805723312010976177544",
"234497171285487369991596629068613293992",
"322308539855900533795957184613951165572",
"282502598271291900225035900305483981290",
"114354123851922950074908240543259669368",
"206490189613942204668194824487839784526",
"215708491005139994277683916560916529583",
"142270628692712362970476711164749353055",
"316985830661747751626061665199483704726",
"44842425417822073122656877622450034998",
"245302777864795696911730949505920772679",
"306965621123553803348986192984644023168",
"189911751770306836562635028865841488377",
"59428087873651469876124700355287767586",
"248685273619588218182138358773371968806",
"74964792076202426878510906725272040332",
"284421031296372231674610905504071987126"
]
},
"deprecated": false,
"id": "CVE-2023-53047-607a0186",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02b296978a2137d7128151c542e84dc96400bc00"
},
{
"signature_type": "Line",
"target": {
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175581571935192748567870035046157423372",
"282574088253263344698449051546636538137",
"251107346330102061567098977912959259706",
"112204422900868273924117189455260367907",
"36708798478795505531247412214475860252",
"129203586056436310470659607378338121248",
"45658863773442858730104250121527472453",
"311420911181726005132766416086339954177",
"317921175549826955713042585436643035096",
"98402905945440095821459055949880369155",
"88127089899232815805723312010976177544",
"234497171285487369991596629068613293992",
"322308539855900533795957184613951165572",
"282502598271291900225035900305483981290",
"114354123851922950074908240543259669368",
"206490189613942204668194824487839784526",
"215708491005139994277683916560916529583",
"142270628692712362970476711164749353055",
"316985830661747751626061665199483704726",
"44842425417822073122656877622450034998",
"245302777864795696911730949505920772679",
"306965621123553803348986192984644023168",
"189911751770306836562635028865841488377",
"59428087873651469876124700355287767586",
"248685273619588218182138358773371968806",
"74964792076202426878510906725272040332",
"284421031296372231674610905504071987126"
]
},
"deprecated": false,
"id": "CVE-2023-53047-677a24f6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63cce9393e4e7dbc5af82dc87e68cb321cb1a78"
},
{
"signature_type": "Line",
"target": {
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175581571935192748567870035046157423372",
"282574088253263344698449051546636538137",
"251107346330102061567098977912959259706",
"112204422900868273924117189455260367907",
"36708798478795505531247412214475860252",
"129203586056436310470659607378338121248",
"45658863773442858730104250121527472453",
"311420911181726005132766416086339954177",
"317921175549826955713042585436643035096",
"98402905945440095821459055949880369155",
"88127089899232815805723312010976177544",
"234497171285487369991596629068613293992",
"322308539855900533795957184613951165572",
"282502598271291900225035900305483981290",
"114354123851922950074908240543259669368",
"206490189613942204668194824487839784526",
"215708491005139994277683916560916529583",
"142270628692712362970476711164749353055",
"316985830661747751626061665199483704726",
"44842425417822073122656877622450034998",
"245302777864795696911730949505920772679",
"306965621123553803348986192984644023168",
"189911751770306836562635028865841488377",
"59428087873651469876124700355287767586",
"248685273619588218182138358773371968806",
"74964792076202426878510906725272040332",
"284421031296372231674610905504071987126"
]
},
"deprecated": false,
"id": "CVE-2023-53047-992db880",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8502fba45bd30e1a6a354d9d898bc99d1a11e6d"
},
{
"signature_type": "Function",
"target": {
"function": "amdtee_open_session",
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"digest": {
"function_hash": "97780375134324593560252410089401672081",
"length": 1582.0
},
"deprecated": false,
"id": "CVE-2023-53047-a0183a81",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f632a90f8e39db39b322107b9a8d438b826a7f4f"
},
{
"signature_type": "Function",
"target": {
"function": "amdtee_open_session",
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"digest": {
"function_hash": "97780375134324593560252410089401672081",
"length": 1582.0
},
"deprecated": false,
"id": "CVE-2023-53047-c3d5e489",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02b296978a2137d7128151c542e84dc96400bc00"
},
{
"signature_type": "Function",
"target": {
"function": "amdtee_open_session",
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"digest": {
"function_hash": "97780375134324593560252410089401672081",
"length": 1582.0
},
"deprecated": false,
"id": "CVE-2023-53047-c80fa7c8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63cce9393e4e7dbc5af82dc87e68cb321cb1a78"
},
{
"signature_type": "Line",
"target": {
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175581571935192748567870035046157423372",
"282574088253263344698449051546636538137",
"251107346330102061567098977912959259706",
"112204422900868273924117189455260367907",
"36708798478795505531247412214475860252",
"129203586056436310470659607378338121248",
"45658863773442858730104250121527472453",
"311420911181726005132766416086339954177",
"317921175549826955713042585436643035096",
"98402905945440095821459055949880369155",
"88127089899232815805723312010976177544",
"234497171285487369991596629068613293992",
"322308539855900533795957184613951165572",
"282502598271291900225035900305483981290",
"114354123851922950074908240543259669368",
"206490189613942204668194824487839784526",
"215708491005139994277683916560916529583",
"142270628692712362970476711164749353055",
"316985830661747751626061665199483704726",
"44842425417822073122656877622450034998",
"245302777864795696911730949505920772679",
"306965621123553803348986192984644023168",
"189911751770306836562635028865841488377",
"59428087873651469876124700355287767586",
"248685273619588218182138358773371968806",
"74964792076202426878510906725272040332",
"284421031296372231674610905504071987126"
]
},
"deprecated": false,
"id": "CVE-2023-53047-ca538287",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3ef9e6fe09f1a132af28c623edcf4d4f39d9f35"
},
{
"signature_type": "Function",
"target": {
"function": "amdtee_open_session",
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"digest": {
"function_hash": "97780375134324593560252410089401672081",
"length": 1582.0
},
"deprecated": false,
"id": "CVE-2023-53047-d0fe9380",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3ef9e6fe09f1a132af28c623edcf4d4f39d9f35"
},
{
"signature_type": "Function",
"target": {
"function": "amdtee_open_session",
"file": "drivers/tee/amdtee/core.c"
},
"signature_version": "v1",
"digest": {
"function_hash": "97780375134324593560252410089401672081",
"length": 1582.0
},
"deprecated": false,
"id": "CVE-2023-53047-e56579fe",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8502fba45bd30e1a6a354d9d898bc99d1a11e6d"
}
]