CVE-2021-47087

What it actually does

The flaw allows an advanced page pointer from a prior allocation to be passed to __free_pages, resulting in deallocation of arbitrary kernel memory pages instead of the intended allocation.

Why it matters to the business

Linux systems relying on OP-TEE for trusted execution can experience unpredictable kernel memory corruption, leading to crashes, instability, or potential escalation of privileges in affected environments.

How an attack unfolds

An attacker with the ability to trigger tee/optee page allocation paths (typically via crafted user-space requests to the OP-TEE driver) can cause the driver to free unrelated kernel pages, corrupting memory structures and potentially enabling further exploitation such as arbitrary code execution or denial of service.

How to fix it

Apply the upstream kernel patch that stops modifying the page pointer before the free operation; rebuild and deploy updated kernel images containing the fix for the tee/optee driver.

How to confirm the fix worked

Inspect the optee driver source for the corrected allocation/free sequence that preserves the original page pointer; boot the patched kernel and confirm absence of the pointer advancement before __free_pages; monitor for related oops or memory corruption warnings during tee operations.

Typical attack path

1. Obtain local access or execute code capable of invoking tee subsystem calls
2. Trigger repeated page allocations in the optee driver to advance the page pointer
3. Force the buggy free path to release arbitrary pages
4. Leverage resulting memory corruption for privilege escalation or system crash

How to detect it

Review kernel logs for oops or BUG messages referencing __free_pages in the optee path; examine dmesg or journalctl output around tee driver activity for unexpected page free warnings; correlate with processes invoking /dev/tee or similar device nodes.

What your security team should do

• Prioritize kernel updates on all systems exposing OP-TEE interfaces
• Audit custom kernel builds or distributions for the presence of the buggy pointer modification
• Enable kernel memory debugging features such as page poisoning during testing to surface corruption