Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers.
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vfs75xx_firmware | Synaptics | 5.2.225.26 (including) | 5.2.225.26 (including) |
| Vfs75xx_firmware | Synaptics | 5.2.318.26 (including) | 5.2.318.26 (including) |
| Vfs75xx_firmware | Synaptics | 5.2.524.26 (including) | 5.2.524.26 (including) |
| Vfs75xx_firmware | Synaptics | 5.2.3530.26 (including) | 5.2.3530.26 (including) |
| Vfs75xx_firmware | Synaptics | 5.3.3539.26 (including) | 5.3.3539.26 (including) |
| Vfs75xx_firmware | Synaptics | 5.5.3.1116 (including) | 5.5.3.1116 (including) |
| Vfs75xx_firmware | Synaptics | 5.5.8.1096 (including) | 5.5.8.1096 (including) |
| Vfs75xx_firmware | Synaptics | 5.5.10.1093 (including) | 5.5.10.1093 (including) |
| Vfs75xx_firmware | Synaptics | 5.5.11.1106 (including) | 5.5.11.1106 (including) |
| Vfs75xx_firmware | Synaptics | 5.5.15.1102 (including) | 5.5.15.1102 (including) |
| Vfs75xx_firmware | Synaptics | 5.5.38.1058 (including) | 5.5.38.1058 (including) |
| Vfs75xx_firmware | Synaptics | 5.5.2734.1050 (including) | 5.5.2734.1050 (including) |
| Vfs75xx_firmware | Synaptics | 5.5.2811.1050 (including) | 5.5.2811.1050 (including) |
| Vfs75xx_firmware | Synaptics | 5.6.23.1000 (including) | 5.6.23.1000 (including) |
| Vfs75xx_firmware | Synaptics | 6.0.14.1108 (including) | 6.0.14.1108 (including) |
| Vfs75xx_firmware | Synaptics | 6.0.32.1104 (including) | 6.0.32.1104 (including) |
| Vfs75xx_firmware | Synaptics | 6.0.42.1107 (including) | 6.0.42.1107 (including) |
This weakness can take several forms, such as: