CVE-2023-41325
CVSS 3.1 Score 7.4 of 10 (high)
Details
Summary
CVE-2023-41325 is a vulnerability that affects OP-TEE, a Trusted Execution Environment (TEE) designed for Arm; Cortex-A cores using TrustZone technology. Versions 3.20 to 3.22 of OP-TEE have a double free vulnerability in the `shdr_verify_signature` function, which is used to verify a TA binary before it is loaded. The vulnerability occurs when allocating memory for the RSA key, where the allocation may succeed for one part of the key (`e`) but fail for another part (`n`). This results in a double free scenario when the memory is freed twice, leading to potential exploitation. A patch has been released in version 3.22 to remediate this vulnerability. The impact of this vulnerability is rated as high, with the potential for attackers with high privileges and local access to exploit it, resulting in high integrity and confidentiality impacts on affected systems.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions