Exploitation Summary
EIP tracks 2 public exploits for CVE-2022-46152. PoCs published by 0xbbdd, qianfei11.
AI-analyzed exploit summary This repository provides a functional proof-of-concept exploit for CVE-2022-46152, an out-of-bounds stack read vulnerability in OP-TEE OS < 3.19.0. The exploit triggers improper validation of array index in `cleanup_shm_refs()`, causing OOB access and potential secure world crashes or heap corruption.
Description
OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_command()` and `entry_open_session()`. The commands `OPTEE_MSG_CMD_OPEN_SESSION` and `OPTEE_MSG_CMD_INVOKE_COMMAND` can be executed from the normal world via an OP-TEE SMC. This function is not validating the `num_params` argument, which is only limited to `OPTEE_MSG_MAX_NUM_PARAMS` (127) in the function `get_cmd_buffer()`. Therefore, an attacker in the normal world can craft an SMC call that will cause out-of-bounds reading in `cleanup_shm_refs` and potentially freeing of fake-objects in the function `mobj_put()`. A normal-world attacker with permission to execute SMC instructions may exploit this flaw. Maintainers believe this problem permits local privilege escalation from the normal world to the secure world. Version 3.19.0 contains a fix for this issue. There are no known workarounds.
Exploits (2)
This repository provides a functional proof-of-concept exploit for CVE-2022-46152, an out-of-bounds stack read vulnerability in OP-TEE OS < 3.19.0. The exploit triggers improper validation of array index in `cleanup_shm_refs()`, causing OOB access and potential secure world crashes or heap corruption.
This repository contains a functional exploit PoC for CVE-2022-46152, an out-of-bounds read vulnerability in OP-TEE OS's `cleanup_shm_refs()` function. The exploit demonstrates the vulnerability by sending an INVOKE request with `num_params=31`, bypassing the libteec 4-parameter limit and triggering an OOB read of secure world stack data.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H