CVE-2022-46152

EIP tracks 1 public exploit for CVE-2022-46152. PoCs published by qianfei11.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2022-46152, an out-of-bounds read vulnerability in OP-TEE OS's `cleanup_shm_refs()` function. The exploit demonstrates the vulnerability by sending an INVOKE request with `num_params=31`, bypassing the libteec 4-parameter limit and triggering an OOB read of secure world stack data.

OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_command()` and `entry_open_session()`. The commands `OPTEE_MSG_CMD_OPEN_SESSION` and `OPTEE_MSG_CMD_INVOKE_COMMAND` can be executed from the normal world via an OP-TEE SMC. This function is not validating the `num_params` argument, which is only limited to `OPTEE_MSG_MAX_NUM_PARAMS` (127) in the function `get_cmd_buffer()`. Therefore, an attacker in the normal world can craft an SMC call that will cause out-of-bounds reading in `cleanup_shm_refs` and potentially freeing of fake-objects in the function `mobj_put()`. A normal-world attacker with permission to execute SMC instructions may exploit this flaw. Maintainers believe this problem permits local privilege escalation from the normal world to the secure world. Version 3.19.0 contains a fix for this issue. There are no known workarounds.