CVE-2023-41325

CVSS 3.1 Score 7.4 of 10 (high)

Details

Published Sep 15, 2023
Updated: Sep 22, 2023
CWE ID 415

Summary

CVE-2023-41325 is a vulnerability that affects OP-TEE, a Trusted Execution Environment (TEE) designed for Arm; Cortex-A cores using TrustZone technology. Versions 3.20 to 3.22 of OP-TEE have a double free vulnerability in the `shdr_verify_signature` function, which is used to verify a TA binary before it is loaded. The vulnerability occurs when allocating memory for the RSA key, where the allocation may succeed for one part of the key (`e`) but fail for another part (`n`). This results in a double free scenario when the memory is freed twice, leading to potential exploitation. A patch has been released in version 3.22 to remediate this vulnerability. The impact of this vulnerability is rated as high, with the potential for attackers with high privileges and local access to exploit it, resulting in high integrity and confidentiality impacts on affected systems.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-41325 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options