OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.16.0 and prior to 4.11.0, a user-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A within OP-TEE SPMC/SP flows. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_SECURE_PARTITION=y`. The function `sp_mem_remove()`, responsible for freeing entries in `smem->receivers` and `smem->regions`, fails to acquire the global `sp_mem_lock` before performing the `free()` operations. Concurrently, other code paths, such as `sp_mem_get_receiver()`, iterate over these same lists without holding a lock, or, like `sp_mem_is_shared()`, iterate while holding the lock but are not serialized against the unprotected `free()` in `sp_mem_remove()`. This creates a cross-thread race where a thread iterating the list can acquire a pointer to an entry (e.g., `struct sp_mem_map_region` or `struct sp_mem_receiver`), and then another thread calls `sp_mem_remove()`, freeing the object. When the first thread resumes and dereferences the pointer, it results in a Use-After-Free vulnerability. Version 4.11.0 fixes the issue.

• https://github.com/OP-TEE/optee_os/security/advisories/GHSA-332c-xr93-849m
• https://github.com/OP-TEE/optee_os/security/advisories/GHSA-332c-xr93-849m

• Linaro » Op-Tee » Version: 3.16.0
  cpe:2.3:o:linaro:op-tee:3.16.0
• Linaro » Op-Tee » Version: 3.17.0
  cpe:2.3:o:linaro:op-tee:3.17.0
• Linaro » Op-Tee » Version: 3.18.0
  cpe:2.3:o:linaro:op-tee:3.18.0
• Linaro » Op-Tee » Version: 3.19.0
  cpe:2.3:o:linaro:op-tee:3.19.0
• Linaro » Op-Tee » Version: 3.20
  cpe:2.3:o:linaro:op-tee:3.20
• Linaro » Op-Tee » Version: 3.20.0
  cpe:2.3:o:linaro:op-tee:3.20.0
• Linaro » Op-Tee » Version: 3.21.0
  cpe:2.3:o:linaro:op-tee:3.21.0
• Linaro » Op-Tee » Version: 3.22.0
  cpe:2.3:o:linaro:op-tee:3.22.0
• Linaro » Op-Tee » Version: 4.0.0
  cpe:2.3:o:linaro:op-tee:4.0.0
• Linaro » Op-Tee » Version: 4.1.0
  cpe:2.3:o:linaro:op-tee:4.1.0
• Linaro » Op-Tee » Version: 4.10.0
  cpe:2.3:o:linaro:op-tee:4.10.0
• Linaro » Op-Tee » Version: 4.2.0
  cpe:2.3:o:linaro:op-tee:4.2.0
• Linaro » Op-Tee » Version: 4.3.0
  cpe:2.3:o:linaro:op-tee:4.3.0
• Linaro » Op-Tee » Version: 4.4.0
  cpe:2.3:o:linaro:op-tee:4.4.0
• Linaro » Op-Tee » Version: 4.5.0
  cpe:2.3:o:linaro:op-tee:4.5.0
• Linaro » Op-Tee » Version: 4.6.0
  cpe:2.3:o:linaro:op-tee:4.6.0
• Linaro » Op-Tee » Version: 4.7.0
  cpe:2.3:o:linaro:op-tee:4.7.0
• Linaro » Op-Tee » Version: 4.8.0
  cpe:2.3:o:linaro:op-tee:4.8.0
• Linaro » Op-Tee » Version: 4.9.0
  cpe:2.3:o:linaro:op-tee:4.9.0