vm_map() and umap_add_region() do not check that given offs + ROUNDUP(len…) do not overflow. As a result the check to see if the region is in within a given memory object can be bypassed and both offset and/or size parameters could be very large.

This could be leverage to alter the intended behavior of functions using either the region size or the region offset, like tee_mmu_user_pa2va_helper() for instance.

Patches

optee_os.git

• core: umap_add_region(): add overflow check (bcc81cf)

Workarounds

N/A

References

N/A

OP-TEE ID

OP-TEE-2019-0017

Reported by

Netflix (Bastien Simondi)

For more information

For more information regarding the security incident process in OP-TEE, please read the information that can be found when going to the "Security" page at https://www.trustedfirmware.org.