What is the CVSS score of CVE-2023-41325?

CVE-2023-41325 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2023-41325?

Yes, a public proof-of-concept exploit is available for CVE-2023-41325. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2023-41325?

Yes, a patch is available for CVE-2023-41325. Update the affected software to the latest version immediately.

Op Tee CVE-2023-41325

HIGH

Double Free (CWE-415)

2023-09-15 security-advisories@github.com

Linux Information Disclosure Op Tee

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Sep 15, 2023 - 20:15 github-advisory

HIGH 7.4

DescriptionGitHub Advisory

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, shdr_verify_signature can make a double free. shdr_verify_signature used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (sw_crypto_acipher_alloc_rsa_public_key) will try to allocate a memory (which is optee’s heap memory). RSA key is consist of exponent and modulus (represent as variable e, n) and it allocation is not atomic way, so it may succeed in e but fail in n. In this case sw_crypto_acipher_alloc_rsa_public_key will free on e and return as it is failed but variable ‘e’ is remained as already freed memory address . shdr_verify_signature will free again that memory (which is e`) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available.

AnalysisAI

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Rated high severity (CVSS 7.4), this vulnerability is low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-415. OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, shdr_verify_signature can make a double free. shdr_verify_signature used to verify a TA binary before it is loaded. To verify a signature of it, allocate a memory for RSA key. RSA key allocate function (sw_crypto_acipher_alloc_rsa_public_key) will try to allocate a memory (which is optee’s heap memory). RSA key is consist of exponent and modulus (represent as variable e, n) and it allocation is not atomic way, so it may succeed in e but fail in n. In this case sw_crypto_acipher_alloc_rsa_public_key will free on e and return as it is failed but variable ‘e’ is remained as already freed memory address . shdr_verify_signature will free again that memory (which is e`) even it is freed when it failed allocate RSA key. A patch is available in version 3.22. No known workarounds are available. Affected products include: Trustedfirmware Op-Tee. Version information: version 3.20.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.