CVE-2023-41325: OP-TEE double free in shdr_verify_signature

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, shdrverifysignature can make a double free. shdrverifysignature used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (swcryptoacipherallocrsapublickey) will try to allocate a memory (which is optee’s heap memory). RSA key is consist of exponent and modulus (represent as variable e, n) and it allocation is not atomic way, so it may succeed in e but fail in n. In this case swcryptoacipherallocrsapublickey will free on e and return as it is failed but variable ‘e’ is remained as already freed memory address . shdrverifysignature will free again that memory (which is e) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available.