From 25b901fa1610bedf12ca1b53d872276232fa860a Mon Sep 17 00:00:00 2001 From: Bohdan Date: Thu, 23 Jul 2026 13:07:54 +0300 Subject: [PATCH] fix(tee): reject invalid session in invoke to close NULL-deref DoS (#247) tee_ioctl_invoke() did not check the result of tee_ta_get_session(). A non-secure caller could send TEE_IOC_INVOKE with an invalid, zero, or stale session id; find_session() returns NULL and tee_ta_invoke_command() then dereferences it (sess->ctx->ops->enter_invoke_cmd, the original guards are commented out), faulting in the secure world -> DoS reachable through the live cmse_nonsecure_entry ioctl veneer. Reject a NULL session with TEEC_ERROR_BAD_PARAMETERS in tee_ioctl_invoke before the session is used, and add a defense-in-depth NULL guard at the top of tee_ta_invoke_command() so no caller can trigger the dereference. close_session is unaffected: tee_ta_close_session() already handles NULL. Co-Authored-By: Claude Opus 4.8 --- tee/kernel/entry_std.c | 13 +++++++++++++ tee/kernel/tee_ta_manager.c | 9 +++++++++ 2 files changed, 22 insertions(+) diff --git a/tee/kernel/entry_std.c b/tee/kernel/entry_std.c index 88b462b1..b2ddc3da 100644 --- a/tee/kernel/entry_std.c +++ b/tee/kernel/entry_std.c @@ -406,6 +406,19 @@ TEEC_Result tee_ioctl_invoke(/*ctx,*/ struct tee_ioctl_buf_data *buf_data) if (res != TEE_SUCCESS) goto out; + if (!sess) { + /* + * A Non-Secure caller can supply an invalid/zero/stale session id. + * find_session() then returns NULL and, since the guards in + * tee_ta_invoke_command() are disabled, the secure world would + * dereference NULL (sess->ctx->...) -> secure-world crash/DoS. + * Reject before invoking. Placed after copy_in_params so a malformed + * request still gets the more specific error from parameter validation. + */ + res = TEEC_ERROR_BAD_PARAMETERS; + goto out; + } + res = tee_ta_invoke_command(&err, sess, arg->func, ¶m); copy_out_param(¶m, arg->num_params, arg->params, saved_attr); diff --git a/tee/kernel/tee_ta_manager.c b/tee/kernel/tee_ta_manager.c index 2cadb4d2..ebaa3813 100644 --- a/tee/kernel/tee_ta_manager.c +++ b/tee/kernel/tee_ta_manager.c @@ -637,6 +637,15 @@ TEE_Result tee_ta_invoke_command(TEE_ErrorOrigin *err, { TEE_Result res; + /* + * Defense in depth: never dereference a NULL session. Callers (e.g. the + * Non-Secure ioctl veneer) obtain sess from tee_ta_get_session(), which + * returns NULL for an unknown session id; without this guard the line + * below would fault in the secure world. + */ + if (!sess) + return TEE_ERROR_BAD_PARAMETERS; + // if (check_client(sess, clnt_id) != TEE_SUCCESS) // return TEE_ERROR_BAD_PARAMETERS; /* intentional generic error */ //