CVE-2022-46152

OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_command()` and `entry_open_session()`. The commands `OPTEE_MSG_CMD_OPEN_SESSION` and `OPTEE_MSG_CMD_INVOKE_COMMAND` can be executed from the normal world via an OP-TEE SMC. This function is not validating the `num_params` argument, which is only limited to `OPTEE_MSG_MAX_NUM_PARAMS` (127) in the function `get_cmd_buffer()`. Therefore, an attacker in the normal world can craft an SMC call that will cause out-of-bounds reading in `cleanup_shm_refs` and potentially freeing of fake-objects in the function `mobj_put()`. A normal-world attacker with permission to execute SMC instructions may exploit this flaw. Maintainers believe this problem permits local privilege escalation from the normal world to the secure world. Version 3.19.0 contains a fix for this issue. There are no known workarounds.

• CWE-129
• CWE-129

• https://github.com/OP-TEE/optee_os/blob/c2d449482de098f1c894b94f338440e5a327813d/core/tee/entry_std.c#L257Third Party Advisory
• https://github.com/OP-TEE/optee_os/commit/728616b28df659cf0bdde6e58a471f6ef25d023cPatch, Third Party Advisory
• https://github.com/OP-TEE/optee_os/security/advisories/GHSA-65w8-6mrg-52g7Exploit, Third Party Advisory
• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:X/RC:X/CR:M/IR:M/AR:M/MAV:L/MAC:L/MPR:H/MUI:N/MS:C/MC:H/MI:H/MA:H&version=3.1Third Party Advisory, US Government Resource
• https://github.com/OP-TEE/optee_os/blob/c2d449482de098f1c894b94f338440e5a327813d/core/tee/entry_std.c#L257Third Party Advisory
• https://github.com/OP-TEE/optee_os/commit/728616b28df659cf0bdde6e58a471f6ef25d023cPatch, Third Party Advisory
• https://github.com/OP-TEE/optee_os/security/advisories/GHSA-65w8-6mrg-52g7Exploit, Third Party Advisory
• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:X/RC:X/CR:M/IR:M/AR:M/MAV:L/MAC:L/MPR:H/MUI:N/MS:C/MC:H/MI:H/MA:H&version=3.1Third Party Advisory, US Government Resource

Published

Nov 29, 2022

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-46147Drag and Drop XBlock v2 implements a drag-and-drop style pro…6.1
• CVE-2022-46148Discourse is an open-source messaging platform. In versions …5.4
• CVE-2022-46149Cap'n Proto is a data interchange format and remote procedur…5.4
• CVE-2022-4615Cross-site Scripting (XSS) - Reflected in GitHub repository …6.1
• CVE-2022-46150Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2022-46151Querybook is an open source data querying UI. In affected ve…6.1
• CVE-2022-46153Traefik is an open source HTTP reverse proxy and load balanc…6.5
• CVE-2022-46154Kodexplorer is a chinese language web based file manager and…7.5
• CVE-2022-46155Airtable.js is the JavaScript client for Airtable. Prior to …6.4
• CVE-2022-46156The Synthetic Monitoring Agent for Grafana's Synthetic Monit…3.3
• CVE-2022-46157Akeneo PIM is an open source Product Information Management …8.8
• CVE-2022-46158PrestaShop is an open-source e-commerce solution. Versions p…4.3