CVE-2022-50080

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tee: add overflow check in register_shm_helper()

With special lengths supplied by user space, register_shm_helper() has

an integer overflow when calculating the number of pages covered by a

supplied user space memory region.

This causes internal_get_user_pages_fast() a helper function of

pin_user_pages_fast() to do a NULL pointer dereference:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010

Modules linked in:

CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11

Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015

pc : internal_get_user_pages_fast+0x474/0xa80

Call trace:

internal_get_user_pages_fast+0x474/0xa80

pin_user_pages_fast+0x24/0x4c

register_shm_helper+0x194/0x330

tee_shm_register_user_buf+0x78/0x120

tee_ioctl+0xd0/0x11a0

__arm64_sys_ioctl+0xa8/0xec

invoke_syscall+0x48/0x114

Fix this by adding an an explicit call to acce

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References