CVE-2024-35785

What it actually does

Incorrect error handling in the OP-TEE TEE bus device registration path dereferences an invalid pointer on failure, triggering a level-1 translation fault and kernel panic (Oops).

Why it matters to the business

Systems using OP-TEE experience sudden kernel crashes and reboots, causing denial of service and loss of trusted execution environment services until patched kernels are deployed.

How an attack unfolds

An error during TEE device enumeration (triggered by commit 7269cba53d90) follows the buggy error path, resulting in an invalid memory access that panics the kernel; listed threat actor context involves Android kernel exploitation attempts.

How to fix it

Upgrade the Linux kernel to version 5.10.215 or later, or apply commit bc40ded92af55760d12bec8222d4108de725dbe4 from the stable repository.

How to confirm the fix worked

Confirm the running kernel reports the fixed commit or version string; reproduce device registration failure scenarios and verify absence of the paging fault oops.

Typical attack path

1. Cause or observe failure during OP-TEE device registration on the TEE bus
2. Execute the incorrect error-handling code path
3. Trigger kernel paging request fault leading to Oops and panic

How to detect it

Search kernel logs and dmesg for 'Unable to handle kernel paging request', 'tee: optee', and 'Internal error: Oops: 0000000096000005' around boot or TEE initialization.

• Unable to handle kernel paging request at virtual address ffff07ed00626d7c
• ESR = 0x0000000096000005
• Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
• tee: optee: Fix kernel panic caused by incorrect error handling

What your security team should do

• Prioritize kernel upgrades on all systems exposing OP-TEE interfaces
• Include the patch in the next maintenance window and test TEE workloads
• Add kernel oops monitoring for the described fault signature