CVE-2023-41325
📋 TL;DR
CVE-2023-41325 is a double-free vulnerability in OP-TEE's TA binary signature verification function. This allows attackers to potentially corrupt memory and execute arbitrary code in the trusted execution environment. Affects OP-TEE versions 3.20 through 3.21 on Arm Cortex-A systems using TrustZone technology.
💻 Affected Systems
- OP-TEE (Open Portable Trusted Execution Environment)
📦 What is this software?
Op Tee by Linaro
Op Tee by Linaro
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Trusted Execution Environment, allowing execution of arbitrary code with TEE privileges, potentially leading to secure data exfiltration or system takeover.
Likely Case
Memory corruption leading to TEE crashes (denial of service) or limited information disclosure from the secure environment.
If Mitigated
If proper isolation is maintained, impact may be limited to TEE crashes without affecting the normal operating system.
🎯 Exploit Status
Exploitation requires ability to load malicious TA binaries and trigger signature verification failures. No public exploits have been reported.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.22
Vendor Advisory: https://github.com/OP-TEE/optee_os/security/advisories/GHSA-jrw7-63cq-7vhm
Restart Required: Yes
Instructions:
1. Update OP-TEE to version 3.22 or later. 2. Rebuild the OP-TEE firmware. 3. Flash the updated firmware to affected devices. 4. Reboot the system to load the patched firmware.
🔧 Temporary Workarounds
Disable TA binary loading
linuxPrevent loading of new TA binaries to avoid triggering the vulnerable code path.
# Configure OP-TEE to disable TA binary loading via secure storage policies
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from loading TA binaries.
- Monitor system logs for TA binary loading attempts and signature verification failures.
🔍 How to Verify
Check if Vulnerable:
Check OP-TEE version: cat /sys/firmware/optee/version or examine boot logs for OP-TEE version information.Check Version:
dmesg | grep -i 'optee' || cat /sys/firmware/optee/version 2>/dev/null || echo 'OP-TEE not detected'Verify Fix Applied:
Verify OP-TEE version is 3.22 or higher and check that the commit e2ec831cb07ed0099535c7c140cb6338aa62816a is included in the build.📡 Detection & Monitoring
Log Indicators:
- TA binary signature verification failures
- OP-TEE memory allocation errors
- Unexpected TEE crashes or resets
Network Indicators:
- Unusual TA binary loading attempts from unexpected sources
SIEM Query:
source="optee" AND ("signature verification failed" OR "double free" OR "memory corruption")🔗 References
- https://github.com/OP-TEE/optee_os/commit/e2ec831cb07ed0099535c7c140cb6338aa62816a
- https://github.com/OP-TEE/optee_os/security/advisories/GHSA-jrw7-63cq-7vhm
- https://github.com/OP-TEE/optee_os/commit/e2ec831cb07ed0099535c7c140cb6338aa62816a
- https://github.com/OP-TEE/optee_os/security/advisories/GHSA-jrw7-63cq-7vhm
