Bug 2030747 (CVE-2021-44733)

Summary: CVE-2021-44733 kernel: use-after-free in the TEE subsystem
Product: [Other] Security Response Reporter: Alex <allarkin>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, adscvr, airlied, alciregi, bdettelb, bhu, brdeoliv, bskeggs, chwhite, crwood, dhoward, dvlasenk, fhrbata, fpacheco, hdegoede, hkrzesin, jarod, jarodwilson, jburrell, jeremy, jfaracco, jforbes, jglisse, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, security-response-team, steved, vkumar, walters, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 5.16 rc7 Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw in the Linux kernel TEE (Trusted Execution Environment) subsystem was found in the way user calls ioctl TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE. A local user could use this flaw to crash the system or escalate their privileges on the system. If the Linux system non configured with the CONFIG_PREEMPT option or CONFIG_CPU_SW_DOMAIN_PAN option enabled, then it is unlikely that a user can trigger this issue.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2022-05-11 12:46:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2030754, 2030755, 2030756, 2033206    
Bug Blocks: 2030292    

Description Alex 2021-12-09 15:55:32 UTC 
There is use-after-free design issue with the lifetime tracking of the tee_shm:dmabuf object.
If dmabuf in the process of being destroyed, and at the same time other process do a call to the IOCTL command TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE referencing that shared memory, then exploitable use-after-free could happen.
It is hard to trigger the issue, so this is like race condition and to trigger it the CONFIG_CPU_SW_DOMAIN_PAN must be disabled and both the kernel must be configured with CONFIG_PREEMPT.

Reference and patch:
https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
Comment 4 Alex 2021-12-15 13:05:09 UTC 
The candidate patch is:
https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
Comment 7 Alex 2021-12-16 08:31:32 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2033206]
Comment 8 Justin M. Forbes 2022-01-05 14:34:34 UTC 
This was fixed for Fedora with the 5.15.12 stable kernel updates.
Comment 9 errata-xmlrpc 2022-05-10 14:40:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1975 https://access.redhat.com/errata/RHSA-2022:1975
Comment 10 errata-xmlrpc 2022-05-10 14:46:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1988 https://access.redhat.com/errata/RHSA-2022:1988
Comment 11 Product Security DevOps Team 2022-05-11 12:46:26 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-44733