Skip to content
CVE PROGRAM SOURCE RECORD6.7 Medium

CVE-2023-28577

Multiple Dmabuf Kernel Address UAF Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
qualcomm

Description

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Qualcomm, Inc. Snapdragon

Default version status: unaffected

  • FastConnect 6800affected
  • FastConnect 6900affected
  • FastConnect 7800affected
  • QCA6391affected
  • QCA6426affected
  • QCA6436affected
  • QCN9074affected
  • QCS410affected
  • QCS610affected
  • SD865 5Gaffected
  • Snapdragon 8 Gen 1 Mobile Platformaffected
  • Snapdragon 865 5G Mobile Platformaffected
  • Snapdragon 865+ 5G Mobile Platform (SM8250-AB)affected
  • Snapdragon 870 5G Mobile Platform (SM8250-AC)affected
  • Snapdragon X55 5G Modem-RF Systemaffected
  • Snapdragon XR2 5G Platformaffected
  • SW5100affected
  • SW5100Paffected
  • SXR2130affected
  • WCD9341affected
  • WCD9370affected
  • WCD9380affected
  • WCN3660Baffected
  • WCN3680Baffected
  • WCN3950affected
  • WCN3980affected
  • WCN3988affected
  • WSA8810affected
  • WSA8815affected
  • WSA8830affected
  • WSA8835affected

References