A use-after-free exists in drivers/tee/teeshm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in teeshmgetfrom_id during an attempt to free a shared memory object.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-44733.json"
[
{
"id": "CVE-2021-44733-123f954d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_op_map_dma_buf"
},
"digest": {
"function_hash": "197001940774769858352409582447008444553",
"length": 73.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-473d3da0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_op_release"
},
"digest": {
"function_hash": "274803954661082394216532064861025423285",
"length": 92.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-4edf5a72",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_get_fd"
},
"digest": {
"function_hash": "231571362203407663396554164446983708004",
"length": 251.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-627c72eb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_release"
},
"digest": {
"function_hash": "241887399921096516490761243928802423332",
"length": 740.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-a0ae2fbb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_op_mmap"
},
"digest": {
"function_hash": "255873534577236200661826245202952566818",
"length": 306.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-af7b5bf1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_alloc"
},
"digest": {
"function_hash": "69681251191178503681987859487765588429",
"length": 1829.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-b3a9195f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_op_unmap_dma_buf"
},
"digest": {
"function_hash": "303088390478216020621693860844245372868",
"length": 73.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-b8fe3069",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_get_from_id"
},
"digest": {
"function_hash": "45463222089752924131691810812090233993",
"length": 402.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-dc583890",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_free"
},
"digest": {
"function_hash": "201303141964786992839535424864303893931",
"length": 133.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-dfa5d290",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"123445230920525680380090198205024698132",
"55003189688391870094576776533749540980",
"315864914903965980371112099249880879011",
"39259102278722188842035908161530275518",
"304011890262838763503080907752092487293",
"129063200857103811880127610471248831996",
"1130162214726559756766478163632078982",
"224017650372719238363771232347659453093",
"204804621416647468175804993845439964717",
"143469943746935902662676013413238444291",
"45448802082148964909520504439292678695",
"259754414301978245339878072846277140647",
"243361360852905225611785902536460281897",
"180050430248943796702676977144293575780",
"45480328309638422640734154782500409646",
"334231089777668717164437194748875753245",
"295955892063044990840334567789371673169",
"236928151801926011233173969209879730781",
"335643563252950433509781874511433878697",
"39406203312587100971579957046104417106",
"250383748770751200425874660874150887895",
"242015190314595546812771565365486953362",
"260100549332683068454509071431866118590",
"258547759070084143184014454238997313854",
"212397689733381795636422395434173729017",
"244584542667969821693407683846088752856",
"111755697343191394204985863183634624357",
"77955668175199899023930928871178539583",
"112323988441058852313940739188904822297",
"319767619807478954920708220649529331863",
"232911486547034209592001067731145594083",
"304045629033482615723781133887722717564",
"137235408843217759143657747147460694592",
"268322146042724153114626280458327285907",
"302220925908313699585723211662736441736",
"203274395152602188414001674992602908949",
"306168591638557918785990661169800939714",
"146556726940414416604695500989576941621",
"20048742833766507803890515271687968231",
"197830994671014578625696896090786910334",
"202478765804318144869680480520738674488",
"207032964877558112834616232227839884826",
"67045605009441455601890167212083264520",
"206676114738618588696638491607682303978",
"55135211715002278730799529999248552950",
"67454902009395846853455607671550196520",
"58282349530546386247437013692082265408",
"240472110663016908951535606925719476227",
"288855313770258236220382644856806078552",
"60012149714321195736116235048128588263",
"244843200773412224573922557526029310105",
"6122552980447690509369432149567845986",
"45691793049276646128296655372648950064",
"288885515686493748373437997540948032001",
"84291526262630087574360132886038547119",
"88730391604186116876613231372982817681",
"75965039240812770786732407626830748314",
"106829993638945260174482508164605884426",
"283707617223102274148180244412481805591",
"95181729783741889283226386322079849658",
"154065041438998084781388141518252422034",
"314274853256933449403694884400960275947",
"128900493120957616054586755397735199599",
"324081484810348204719785201537842491687",
"299014002380342979765761652438446130037",
"95187849750684904639746400281677509586",
"298913508855888201948332340421033017155",
"35713786359203632059521240575430340422",
"290968531393390914740098141644018325618",
"214873662337083940137640513689082849089",
"221317497878868438179524600418619366401",
"286472617465133033518641809097671259824",
"101186049882186490047215397603667550113",
"219368692079680431541002560987230529482",
"292231501737148462936085835586742509774",
"8129375667972210214064491682383815620",
"213022605394244535012682729312377268586",
"78044928625629373554577713538683328064",
"66706218582937298286043375302884485447",
"191601805568210466485863099506730807572",
"335643563252950433509781874511433878697",
"26650945756284933293843329891076610407",
"301033769291811166913334422935668157263",
"338450634947445521542612718146917476416",
"13842174084314760652456723656608031984",
"277639092326211253104148411971945768758",
"125117235999354145269688117033726639993",
"73238770920166095747874654906477823001",
"123499848224487148000779266689226516716",
"251663939775518188991048416395225087823",
"335834154651882968069670988950245194707",
"157124211220491533858167112907431588473",
"298913508855888201948332340421033017155",
"35713786359203632059521240575430340422",
"290968531393390914740098141644018325618",
"214873662337083940137640513689082849089",
"307616043498431874513737549522853388957",
"186998138349186773229406066487440497781",
"44120582376462965219176930803176623584",
"86365765317038150603092960677002447174",
"115945577677306257039750863314034542040",
"126620485265896059669516632726650747564",
"211658746567694981864769021982596576814",
"284813243061653338387766905879604003555",
"265702613320592738337961564406000324200",
"91322613754010193278720392610235151775",
"227830949526398554842699848036433379933",
"106931541502915672648164641446539637206",
"224527557851270937871520307922894379499",
"133904351525394717080834855452421545738",
"82213692000137859032348648059233759714",
"208846872987955215848897483287988075299",
"31111082131046459870934661030280358416",
"321681443294163087963848034743727153481",
"185327401848291428979822339457647802490",
"325666310623313630046044657754960621122",
"249143023415819905830262394399478647732",
"114741865154438378893006387078427564970",
"288161570886396147706695231536207163674",
"170055327862645242990283019533027221516",
"55366044685890540885117624489083026790",
"140537261278480550136357033329535943591",
"262597395422864711869374009091618466948",
"25754704755863157603222488879909645137",
"188152945082380520137306329169217999115",
"112857852547634468158736794843925491400",
"36468101184978944904673317573691585289",
"182519721169942556704211676951150531516",
"305873752254963666975415306202680296676",
"222723480919879717813081028544730202699",
"160046451933988816590724392711990701729",
"97251309492519509536372689936909701981"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2021-44733-e26578b2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_register"
},
"digest": {
"function_hash": "74069509815568174506842527665938766449",
"length": 2659.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-f89a4465",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "drivers/tee/tee_shm.c",
"function": "tee_shm_put"
},
"digest": {
"function_hash": "20094165556684214499378198381961196474",
"length": 107.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2021-44733-fc21b83e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfd0743f1d9ea76931510ed150334d571fbab49d",
"target": {
"file": "include/linux/tee_drv.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"175096465059077395894115049989788279145",
"185429035548739880926739906017069557694",
"278853380259283754387410593828630332031",
"119428836136306861258166552500617024150",
"258172609397630004172732108819334360339",
"225415084022720823584640408321822109580",
"215937544750041873168594427708993323273"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
}
]