Description
In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size and passes it to alloc_pages_exact() without checking it. For size == 0 nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page allocator then trips its order > MAX_PAGE_ORDER warning and fails the allocation; on a panic_on_warn kernel that ends the boot. This can be triggered by TEE_IOC_SHM_ALLOC with struct tee_ioctl_shm_alloc_data where size is 0. Reject a zero page count, as register_shm_helper() already does for the register path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
cf4441503e20a0c0a36e0a98dcf57de3d3844c91 to < e5dc7af9c3a5373ee7a84959126e7dfa9e4ad50daffectedcf4441503e20a0c0a36e0a98dcf57de3d3844c91 to < 65cb86860a80ffc6af897d53f5bd4b1733bca0ecaffectedcf4441503e20a0c0a36e0a98dcf57de3d3844c91 to < c2a97703359e25ec7ef8b2b0ef32fb3982add90aaffectedcf4441503e20a0c0a36e0a98dcf57de3d3844c91 to < b7f925fd5226deb953c8dcdc9677d3fcc2717c00affected
Linux Linux
Default version status: affected
6.10affected0 to < 6.10unaffected6.12.113 to ≤ 6.12.*unaffected6.18.57 to ≤ 6.18.*unaffected7.2.11 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected