CVE-2023-52503

What it actually does

Race condition in amdtee session refcount handling allows concurrent open_session to reuse a session pointer that destroy_session is about to free, resulting in use-after-free.

Why it matters to the business

Systems using AMD TEE on Linux kernels may experience crashes, memory corruption, or potential local privilege escalation, increasing downtime and security risk until patched.

How an attack unfolds

An attacker with local access spawns multiple threads that simultaneously invoke amdtee_open_session and amdtee_close_session; when refcount reaches one, the race lets alloc_session return a pointer that destroy_session frees, enabling the attacker to write to freed kernel memory.

How to fix it

Upgrade the Linux kernel to a version containing commit da7ce52a2f6c468946195b116615297d3d113a27, which makes the refcount decrement and session-list removal atomic inside destroy_session.

How to confirm the fix worked

Inspect the amdtee driver source for the patched destroy_session function; confirm the critical section protects both kref_put and list removal, then verify the running kernel reports the fixed commit or later.

Typical attack path

1. Obtain local execution on an affected AMD Linux system
2. Trigger concurrent amdtee_open_session and amdtee_close_session calls
3. Win the race so open_session receives a soon-to-be-freed session object
4. Perform use-after-free writes to corrupt kernel structures or redirect execution

How to detect it

Search kernel logs for amdtee-related oops, use-after-free warnings, or session list corruption; correlate with processes making frequent TEE open/close calls.

What your security team should do

• Apply the referenced kernel commit or newer stable release to all affected hosts
• Prioritize patching systems that expose TEE interfaces or run untrusted workloads
• Rebuild and distribute updated kernel packages through existing update channels
• Review and restrict user-space access to /dev/tee* devices where feasible