In the Linux kernel, the following vulnerability has been resolved:
tee: amdtee: fix use-after-free vulnerability in amdteeclosesession
There is a potential race condition in amdteeclosesession that may cause use-after-free in amdteeopensession. For instance, if a session has refcount == 1, and one thread tries to free this session via:
kref_put(&sess->refcount, destroy_session);
the reference count will get decremented, and the next step would be to call destroysession(). However, if in another thread, amdteeopensession() is called before destroysession() has completed execution, allocsession() may return 'sess' that will be freed up later in destroysession() leading to use-after-free in amdteeopensession.
To fix this issue, treat decrement of sess->refcount and removal of 'sess' from session list in destroy_session() as a critical section, so that it is executed atomically.
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "length": 605.0, "function_hash": "145278395822626077055716000599181191036" }, "id": "CVE-2023-52503-01ee7188", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_close_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c95574350cd63bc3c5c2fa06658010768f2a0ce" }, { "signature_version": "v1", "digest": { "length": 605.0, "function_hash": "145278395822626077055716000599181191036" }, "id": "CVE-2023-52503-097c6409", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_close_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4384b3e54ea813868bb81a861bf5b2406e15d8f" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "126360496815748074991875637442517395469", "253490829958995023100811263539942207989", "23714925617890453664348902909621939880", "38230623563257638985069494508959141214", "599541727803809079680550764699877688", "78805085082891610866523156196358912253", "336808753349013669575154333729930327771", "324125541501973268756000020509631636716", "206637800752862402420933251241517676800", "150283683559160213392422850258429263011", "306965621123553803348986192984644023168", "157761188452261011663823526265053108071", "228578090613279868595506079430401994231", "201962529266429478078704296088364336160", "88127089899232815805723312010976177544", "234497171285487369991596629068613293992", "180198931717923440026921430990351585748", "230841935279462218315908053173888805164", "317399574975003656081017500208970362355", "176087735646612783586932496116934280076" ] }, "id": "CVE-2023-52503-0b6346e1", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1680c82929bc14d706065f123dab77f2f1293116" }, { "signature_version": "v1", "digest": { "length": 1515.0, "function_hash": "104334254963605066943838960128668039320" }, "id": "CVE-2023-52503-449250b9", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_open_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da7ce52a2f6c468946195b116615297d3d113a27" }, { "signature_version": "v1", "digest": { "length": 261.0, "function_hash": "257757268887742279836080828042420926197" }, "id": "CVE-2023-52503-49a8a860", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "destroy_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1680c82929bc14d706065f123dab77f2f1293116" }, { "signature_version": "v1", "digest": { "length": 261.0, "function_hash": "257757268887742279836080828042420926197" }, "id": "CVE-2023-52503-4cfa9ce7", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "destroy_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c3e7a00db954947c265b55099c21b216f2a05c" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "126360496815748074991875637442517395469", "253490829958995023100811263539942207989", "23714925617890453664348902909621939880", "38230623563257638985069494508959141214", "599541727803809079680550764699877688", "78805085082891610866523156196358912253", "336808753349013669575154333729930327771", "324125541501973268756000020509631636716", "206637800752862402420933251241517676800", "150283683559160213392422850258429263011", "306965621123553803348986192984644023168", "157761188452261011663823526265053108071", "228578090613279868595506079430401994231", "201962529266429478078704296088364336160", "88127089899232815805723312010976177544", "234497171285487369991596629068613293992", "180198931717923440026921430990351585748", "230841935279462218315908053173888805164", "317399574975003656081017500208970362355", "176087735646612783586932496116934280076" ] }, "id": "CVE-2023-52503-663ed73c", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c3e7a00db954947c265b55099c21b216f2a05c" }, { "signature_version": "v1", "digest": { "length": 261.0, "function_hash": "257757268887742279836080828042420926197" }, "id": "CVE-2023-52503-6fa00d8e", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "destroy_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4384b3e54ea813868bb81a861bf5b2406e15d8f" }, { "signature_version": "v1", "digest": { "length": 605.0, "function_hash": "145278395822626077055716000599181191036" }, "id": "CVE-2023-52503-7ab70e33", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_close_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c3e7a00db954947c265b55099c21b216f2a05c" }, { "signature_version": "v1", "digest": { "length": 605.0, "function_hash": "145278395822626077055716000599181191036" }, "id": "CVE-2023-52503-85e68e6b", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_close_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1680c82929bc14d706065f123dab77f2f1293116" }, { "signature_version": "v1", "digest": { "length": 1515.0, "function_hash": "104334254963605066943838960128668039320" }, "id": "CVE-2023-52503-95eed589", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_open_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c3e7a00db954947c265b55099c21b216f2a05c" }, { "signature_version": "v1", "digest": { "length": 1515.0, "function_hash": "104334254963605066943838960128668039320" }, "id": "CVE-2023-52503-a9fb04ab", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_open_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c95574350cd63bc3c5c2fa06658010768f2a0ce" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "126360496815748074991875637442517395469", "253490829958995023100811263539942207989", "23714925617890453664348902909621939880", "38230623563257638985069494508959141214", "599541727803809079680550764699877688", "78805085082891610866523156196358912253", "336808753349013669575154333729930327771", "324125541501973268756000020509631636716", "206637800752862402420933251241517676800", "150283683559160213392422850258429263011", "306965621123553803348986192984644023168", "157761188452261011663823526265053108071", "228578090613279868595506079430401994231", "201962529266429478078704296088364336160", "88127089899232815805723312010976177544", "234497171285487369991596629068613293992", "180198931717923440026921430990351585748", "230841935279462218315908053173888805164", "317399574975003656081017500208970362355", "176087735646612783586932496116934280076" ] }, "id": "CVE-2023-52503-aad981b4", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da7ce52a2f6c468946195b116615297d3d113a27" }, { "signature_version": "v1", "digest": { "length": 1515.0, "function_hash": "104334254963605066943838960128668039320" }, "id": "CVE-2023-52503-ad866bf4", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_open_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4384b3e54ea813868bb81a861bf5b2406e15d8f" }, { "signature_version": "v1", "digest": { "length": 261.0, "function_hash": "257757268887742279836080828042420926197" }, "id": "CVE-2023-52503-bd16679e", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "destroy_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da7ce52a2f6c468946195b116615297d3d113a27" }, { "signature_version": "v1", "digest": { "length": 1515.0, "function_hash": "104334254963605066943838960128668039320" }, "id": "CVE-2023-52503-bfd5619b", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_open_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1680c82929bc14d706065f123dab77f2f1293116" }, { "signature_version": "v1", "digest": { "length": 605.0, "function_hash": "145278395822626077055716000599181191036" }, "id": "CVE-2023-52503-d965517b", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "amdtee_close_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da7ce52a2f6c468946195b116615297d3d113a27" }, { "signature_version": "v1", "digest": { "length": 261.0, "function_hash": "257757268887742279836080828042420926197" }, "id": "CVE-2023-52503-df4591a9", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c", "function": "destroy_session" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c95574350cd63bc3c5c2fa06658010768f2a0ce" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "126360496815748074991875637442517395469", "253490829958995023100811263539942207989", "23714925617890453664348902909621939880", "38230623563257638985069494508959141214", "599541727803809079680550764699877688", "78805085082891610866523156196358912253", "336808753349013669575154333729930327771", "324125541501973268756000020509631636716", "206637800752862402420933251241517676800", "150283683559160213392422850258429263011", "306965621123553803348986192984644023168", "157761188452261011663823526265053108071", "228578090613279868595506079430401994231", "201962529266429478078704296088364336160", "88127089899232815805723312010976177544", "234497171285487369991596629068613293992", "180198931717923440026921430990351585748", "230841935279462218315908053173888805164", "317399574975003656081017500208970362355", "176087735646612783586932496116934280076" ] }, "id": "CVE-2023-52503-f01e95c6", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c95574350cd63bc3c5c2fa06658010768f2a0ce" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "126360496815748074991875637442517395469", "253490829958995023100811263539942207989", "23714925617890453664348902909621939880", "38230623563257638985069494508959141214", "599541727803809079680550764699877688", "78805085082891610866523156196358912253", "336808753349013669575154333729930327771", "324125541501973268756000020509631636716", "206637800752862402420933251241517676800", "150283683559160213392422850258429263011", "306965621123553803348986192984644023168", "157761188452261011663823526265053108071", "228578090613279868595506079430401994231", "201962529266429478078704296088364336160", "88127089899232815805723312010976177544", "234497171285487369991596629068613293992", "180198931717923440026921430990351585748", "230841935279462218315908053173888805164", "317399574975003656081017500208970362355", "176087735646612783586932496116934280076" ] }, "id": "CVE-2023-52503-fc9b723a", "deprecated": false, "target": { "file": "drivers/tee/amdtee/core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4384b3e54ea813868bb81a861bf5b2406e15d8f" } ] }