In the Linux kernel, the following vulnerability has been resolved:
tee: amdtee: fix race condition in amdteeopensession
There is a potential race condition in amdteeopensession that may lead to use-after-free. For instance, in amdteeopensession() after sess->sess_mask is set, and before setting:
sess->session_info[i] = session_info;
if amdteeclosesession() closes this same session, then 'sess' data structure will be released, causing kernel panic when 'sess' is accessed within amdteeopensession().
The solution is to set the bit sess->sessmask as the last step in amdteeopen_session().
{ "vanir_signatures": [ { "target": { "file": "drivers/tee/amdtee/core.c" }, "signature_version": "v1", "id": "CVE-2023-53047-2f53ec21", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f632a90f8e39db39b322107b9a8d438b826a7f4f", "digest": { "line_hashes": [ "175581571935192748567870035046157423372", "282574088253263344698449051546636538137", "251107346330102061567098977912959259706", "112204422900868273924117189455260367907", "36708798478795505531247412214475860252", "129203586056436310470659607378338121248", "45658863773442858730104250121527472453", "311420911181726005132766416086339954177", "317921175549826955713042585436643035096", "98402905945440095821459055949880369155", "88127089899232815805723312010976177544", "234497171285487369991596629068613293992", "322308539855900533795957184613951165572", "282502598271291900225035900305483981290", "114354123851922950074908240543259669368", "206490189613942204668194824487839784526", "215708491005139994277683916560916529583", "142270628692712362970476711164749353055", "316985830661747751626061665199483704726", "44842425417822073122656877622450034998", "245302777864795696911730949505920772679", "306965621123553803348986192984644023168", "189911751770306836562635028865841488377", "59428087873651469876124700355287767586", "248685273619588218182138358773371968806", "74964792076202426878510906725272040332", "284421031296372231674610905504071987126" ], "threshold": 0.9 }, "deprecated": false }, { "target": { "file": "drivers/tee/amdtee/core.c" }, "signature_version": "v1", "id": "CVE-2023-53047-607a0186", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02b296978a2137d7128151c542e84dc96400bc00", "digest": { "line_hashes": [ "175581571935192748567870035046157423372", "282574088253263344698449051546636538137", "251107346330102061567098977912959259706", "112204422900868273924117189455260367907", "36708798478795505531247412214475860252", "129203586056436310470659607378338121248", "45658863773442858730104250121527472453", "311420911181726005132766416086339954177", "317921175549826955713042585436643035096", "98402905945440095821459055949880369155", "88127089899232815805723312010976177544", "234497171285487369991596629068613293992", "322308539855900533795957184613951165572", "282502598271291900225035900305483981290", "114354123851922950074908240543259669368", "206490189613942204668194824487839784526", "215708491005139994277683916560916529583", "142270628692712362970476711164749353055", "316985830661747751626061665199483704726", "44842425417822073122656877622450034998", "245302777864795696911730949505920772679", "306965621123553803348986192984644023168", "189911751770306836562635028865841488377", "59428087873651469876124700355287767586", "248685273619588218182138358773371968806", "74964792076202426878510906725272040332", "284421031296372231674610905504071987126" ], "threshold": 0.9 }, "deprecated": false }, { "target": { "file": "drivers/tee/amdtee/core.c" }, "signature_version": "v1", "id": "CVE-2023-53047-677a24f6", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63cce9393e4e7dbc5af82dc87e68cb321cb1a78", "digest": { "line_hashes": [ "175581571935192748567870035046157423372", "282574088253263344698449051546636538137", "251107346330102061567098977912959259706", "112204422900868273924117189455260367907", "36708798478795505531247412214475860252", "129203586056436310470659607378338121248", "45658863773442858730104250121527472453", "311420911181726005132766416086339954177", "317921175549826955713042585436643035096", "98402905945440095821459055949880369155", "88127089899232815805723312010976177544", "234497171285487369991596629068613293992", "322308539855900533795957184613951165572", "282502598271291900225035900305483981290", "114354123851922950074908240543259669368", "206490189613942204668194824487839784526", "215708491005139994277683916560916529583", "142270628692712362970476711164749353055", "316985830661747751626061665199483704726", "44842425417822073122656877622450034998", "245302777864795696911730949505920772679", "306965621123553803348986192984644023168", "189911751770306836562635028865841488377", "59428087873651469876124700355287767586", "248685273619588218182138358773371968806", "74964792076202426878510906725272040332", "284421031296372231674610905504071987126" ], "threshold": 0.9 }, "deprecated": false }, { "target": { "file": "drivers/tee/amdtee/core.c" }, "signature_version": "v1", "id": "CVE-2023-53047-992db880", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8502fba45bd30e1a6a354d9d898bc99d1a11e6d", "digest": { "line_hashes": [ "175581571935192748567870035046157423372", "282574088253263344698449051546636538137", "251107346330102061567098977912959259706", "112204422900868273924117189455260367907", "36708798478795505531247412214475860252", "129203586056436310470659607378338121248", "45658863773442858730104250121527472453", "311420911181726005132766416086339954177", "317921175549826955713042585436643035096", "98402905945440095821459055949880369155", "88127089899232815805723312010976177544", "234497171285487369991596629068613293992", "322308539855900533795957184613951165572", "282502598271291900225035900305483981290", "114354123851922950074908240543259669368", "206490189613942204668194824487839784526", "215708491005139994277683916560916529583", "142270628692712362970476711164749353055", "316985830661747751626061665199483704726", "44842425417822073122656877622450034998", "245302777864795696911730949505920772679", "306965621123553803348986192984644023168", "189911751770306836562635028865841488377", "59428087873651469876124700355287767586", "248685273619588218182138358773371968806", "74964792076202426878510906725272040332", "284421031296372231674610905504071987126" ], "threshold": 0.9 }, "deprecated": false }, { "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_open_session" }, "signature_version": "v1", "id": "CVE-2023-53047-a0183a81", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f632a90f8e39db39b322107b9a8d438b826a7f4f", "digest": { "length": 1582.0, "function_hash": "97780375134324593560252410089401672081" }, "deprecated": false }, { "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_open_session" }, "signature_version": "v1", "id": "CVE-2023-53047-c3d5e489", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02b296978a2137d7128151c542e84dc96400bc00", "digest": { "length": 1582.0, "function_hash": "97780375134324593560252410089401672081" }, "deprecated": false }, { "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_open_session" }, "signature_version": "v1", "id": "CVE-2023-53047-c80fa7c8", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63cce9393e4e7dbc5af82dc87e68cb321cb1a78", "digest": { "length": 1582.0, "function_hash": "97780375134324593560252410089401672081" }, "deprecated": false }, { "target": { "file": "drivers/tee/amdtee/core.c" }, "signature_version": "v1", "id": "CVE-2023-53047-ca538287", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3ef9e6fe09f1a132af28c623edcf4d4f39d9f35", "digest": { "line_hashes": [ "175581571935192748567870035046157423372", "282574088253263344698449051546636538137", "251107346330102061567098977912959259706", "112204422900868273924117189455260367907", "36708798478795505531247412214475860252", "129203586056436310470659607378338121248", "45658863773442858730104250121527472453", "311420911181726005132766416086339954177", "317921175549826955713042585436643035096", "98402905945440095821459055949880369155", "88127089899232815805723312010976177544", "234497171285487369991596629068613293992", "322308539855900533795957184613951165572", "282502598271291900225035900305483981290", "114354123851922950074908240543259669368", "206490189613942204668194824487839784526", "215708491005139994277683916560916529583", "142270628692712362970476711164749353055", "316985830661747751626061665199483704726", "44842425417822073122656877622450034998", "245302777864795696911730949505920772679", "306965621123553803348986192984644023168", "189911751770306836562635028865841488377", "59428087873651469876124700355287767586", "248685273619588218182138358773371968806", "74964792076202426878510906725272040332", "284421031296372231674610905504071987126" ], "threshold": 0.9 }, "deprecated": false }, { "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_open_session" }, "signature_version": "v1", "id": "CVE-2023-53047-d0fe9380", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3ef9e6fe09f1a132af28c623edcf4d4f39d9f35", "digest": { "length": 1582.0, "function_hash": "97780375134324593560252410089401672081" }, "deprecated": false }, { "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_open_session" }, "signature_version": "v1", "id": "CVE-2023-53047-e56579fe", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8502fba45bd30e1a6a354d9d898bc99d1a11e6d", "digest": { "length": 1582.0, "function_hash": "97780375134324593560252410089401672081" }, "deprecated": false } ] }