The function set_rmem_param is a helper function used when copying parameters locally for TA calls. It is used when a parameter is a buffer of type rmem. The function receives an input parameter param from the REE and an output parameter mem. After finding the shared memory object referenced by param the offset and size members of param are copied into mem as is. There is no validation done to ensure that these members actually do reside in shared memory. There is no further checking done on param before it gets passed on to the TA through the function pointer sess->ctx->ops->enter_invoke_cmd in the function tee_ta_invoke_command. How this problem manifests itself is very dependent on how the passed parameters are used by the TA. However, it could lead to corruption of any memory which the TA can access.

Patches

optee_os.git

• core: ensure that supplied range matches MOBJ (e3adcf5)

Workarounds

N/A

References

N/A

OP-TEE ID

OP-TEE-2018-0004

Reported by

Riscure

For more information

For more information regarding the security incident process in OP-TEE, please read the information that can be found when going to the "Security" page at https://www.trustedfirmware.org.