CVE-2021-44733: Use After Free
A use-after-free exists in drivers/tee/teeshm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in teeshmgetfromid during an attempt to free a shared memory object.
Other sources
A use-after-free flaw in the Linux kernel TEE (Trusted Execution Environment) subsystem was found in the way user calls ioctl TEEIOCOPENSESSION or TEEIOCINVOKE. A local user could use this flaw to crash the system or escalate their privileges on the system. If the Linux system non configured with the CONFIGPREEMPT option or CONFIGCPUSWDOMAINPAN option enabled, then it is unlikely that a user can trigger this issue.
There is use-after-free design issue with the lifetime tracking of the teeshm:dmabuf object. If dmabuf in the process of being destroyed, and at the same time other process do a call to the IOCTL command TEEIOCOPENSESSION or TEEIOCINVOKE referencing that shared memory, then exploitable use-after-free could happen. It is hard to trigger the issue, so this is like race condition and to trigger it the CONFIGCPUSWDOMAINPAN must be disabled and both the kernel must be configured with CONFIGPREEMPT.
Reference and patch: https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.rt7.166.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.16 - Compensating control
Mitigation: prevent the modules "tee" and "trusted_tee" from being loaded (e.g., blacklist the kernel modules so they do not auto-load).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-44733?
CVE-2021-44733 has been rated as having a high severity due to its potential to allow arbitrary code execution in the Linux kernel.
How do I fix CVE-2021-44733?
To fix CVE-2021-44733, upgrade to the kernel versions 0:4.18.0-372.9.1.rt7.166.el8, 0:4.18.0-372.9.1.el8, or any version starting from 5.16.
Which systems are affected by CVE-2021-44733?
CVE-2021-44733 affects various Linux distributions including Red Hat Enterprise Linux 8.0, Fedora 35, and Debian versions 9.0, 10.0, and 11.0.
What is a use-after-free vulnerability related to CVE-2021-44733?
A use-after-free vulnerability occurs when memory is freed but still accessible, allowing malicious exploitation and potential system compromise.
Is there any mitigation for CVE-2021-44733 aside from patching?
There are no specific mitigations for CVE-2021-44733; the recommended action is to apply the provided patches as soon as possible.