CVE-2022-46152: OP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs function
First published: Tue Nov 29 2022(Updated: )
OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_command()` and `entry_open_session()`. The commands `OPTEE_MSG_CMD_OPEN_SESSION` and `OPTEE_MSG_CMD_INVOKE_COMMAND` can be executed from the normal world via an OP-TEE SMC. This function is not validating the `num_params` argument, which is only limited to `OPTEE_MSG_MAX_NUM_PARAMS` (127) in the function `get_cmd_buffer()`. Therefore, an attacker in the normal world can craft an SMC call that will cause out-of-bounds reading in `cleanup_shm_refs` and potentially freeing of fake-objects in the function `mobj_put()`. A normal-world attacker with permission to execute SMC instructions may exploit this flaw. Maintainers believe this problem permits local privilege escalation from the normal world to the secure world. Version 3.19.0 contains a fix for this issue. There are no known workarounds.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OP-TEE | <3.19.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/OP-TEE/optee_os/blob/c2d449482de098f1c894b94f338440e5a327813d/core/tee/entry_std.c#L257
- https://github.com/OP-TEE/optee_os/commit/728616b28df659cf0bdde6e58a471f6ef25d023c
- https://github.com/OP-TEE/optee_os/security/advisories/GHSA-65w8-6mrg-52g7
- https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:X/RC:X/CR:M/IR:M/AR:M/MAV:L/MAC:L/MPR:H/MUI:N/MS:C/MC:H/MI:H/MA:H&version=3.1
Frequently Asked Questions
What is the severity of CVE-2022-46152?
CVE-2022-46152 has a moderate severity level due to the potential for an attacker to exploit the improper validation of array index.
How do I fix CVE-2022-46152?
To fix CVE-2022-46152, upgrade OP-TEE Trusted OS to version 3.19.0 or later, where the vulnerability is addressed.
What software versions are affected by CVE-2022-46152?
CVE-2022-46152 affects versions of OP-TEE Trusted OS prior to 3.19.0.
What impact could CVE-2022-46152 have on my system?
The impact of CVE-2022-46152 could allow unauthorized access to sensitive information or commands within the Trusted Execution Environment.
Who is responsible for addressing CVE-2022-46152?
The maintainers of the OP-TEE project are responsible for addressing CVE-2022-46152 and providing updates to mitigate the vulnerability.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/remedy
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/author
- agent/last-modified-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/op-tee
- canonical/op-tee