PT-2026-122001
CVE-2026-99024
·
Publicado
2026-10-23
·
Atualizado
2026-10-23
Descrição por
Pontuação
N/A
Não disponívelNão há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
optee: register TEE devices only once fully initialized
optee probe() called tee device register() on both the client and the
supplicant device before the rest of struct optee had been initialized.
tee device register() calls cdev device add(), which does two things at
once: it creates /dev/tee0 and /dev/teepriv0, and it links the device
into the tee class so that class find device() can find it. From that
moment on the device is reachable both from user space via tee open()
and from kernel space via tee client open context(). The only gate in
teedev open() is tee device get(), which merely checks that
teedev->desc is non-NULL, which was already set by tee device alloc().
Therefore, there is effectively no gate at all.
A context opened in that window can run against a struct optee where
- optee->call queue.mutex is not initialized by optee cq init()
- optee->supp mutex and completions is not initialized by optee supp init()
- optee->rpmb dev mutex is not initialized yet,
- the message argument cache is not initialized by optee shm arg cache init()
- optee->ctx is still NULL
Any open session or invoke during this window takes uninitialized
mutexes and dereferences a NULL pointer.
Fix it by moving both tee device register() calls down to the point
where all of struct optee is set up.
[JW: adding fixes and cc]
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾