Samsung ARM TrustZone TEE: Non-secure Pointer Validation & TOCTOU Fix

Vulnerability Intelligence Summary Vulnerability Overview Title: Status: Merged; merged by on July 28 into . Vulnerability Type: Security vulnerability — Non-secure callers can pass non-secure pointers (arbitrary memory buffers) as arguments via the interface in to read from or write to the secure world, thereby compromising TrustZone's isolation guarantees. Risk: A malicious NS caller may pass arbitrary memory buffers into the secure world through handle operations such as , , and , leading to unauthorized reads and writes. Scope of Impact Affected Files: - - - Affected Platforms: ARM architectures ( , ); RISC-V targets are unaffected as they do not have an NS-SC call boundary. Affected Modules: Pointer validation logic in and . Fix Details 1. Pointer Attribute Validation: In , invoke for all non-secure pointers, validating pointer ranges before handle operations such as , , and . 2. Double-Fetch / TOCTOU Protection: In , perform snapshot validation on non-secure pointers in output parameters to prevent TOCTOU race conditions. 3. Rejection of Non-Zero Returns: In , treat any non-zero value returned by as to prevent misuse of uninitialized values. POC / Test Code The page does not include a standalone POC code block, but provides the test configuration and methodology: Test Methodology: Build and run QEMU ( ), using a dedicated negative test application and a reproducible test framework (added by the developer, not part of this PR). Negative Test: Construct a container handle, invoke , , and with a non-secure memory buffer, expecting a return value of . Positive Path (Non-Failure Path): Use a valid NS memory buffer, expecting a successful operation. TOCTOU Model: Pre-redirect NS memory, inserting the redirection between the snapshot and usage to verify that the snapshot mode (users of ) is unaffected. Counter Check (Non-Race): Verify that after the fix, negative test cases are not rejected, and that the secure world re-reads the caller's behavior to confirm the effectiveness of the guard mechanism. Change Type Type: Bug fix (non-breaking change, resolving a security vulnerability) Impact: Fixes missing pointer validation in , strengthening protection at the secure-world boundary.

Goal Reached Thanks to every supporter — we hit 100%!

Samsung ARM TrustZone TEE: Non-secure Pointer Validation & TOCTOU Fix

More from this source