7.8

CVE-2023-28577

Multiple Dmabuf Kernel Address UAF Vulnerability

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Qualcomm ≫ Fastconnect 6800 Firmware Version -
   Qualcomm ≫ Fastconnect 6800 Version -
Qualcomm ≫ Fastconnect 6900 Firmware Version -
   Qualcomm ≫ Fastconnect 6900 Version -
Qualcomm ≫ Fastconnect 7800 Firmware Version -
   Qualcomm ≫ Fastconnect 7800 Version -
Qualcomm ≫ Qca6391 Firmware Version -
   Qualcomm ≫ Qca6391 Version -
Qualcomm ≫ Qca6426 Firmware Version -
   Qualcomm ≫ Qca6426 Version -
Qualcomm ≫ Qca6436 Firmware Version -
   Qualcomm ≫ Qca6436 Version -
Qualcomm ≫ Qcn9074 Firmware Version -
   Qualcomm ≫ Qcn9074 Version -
Qualcomm ≫ Qcs410 Firmware Version -
   Qualcomm ≫ Qcs410 Version -
Qualcomm ≫ Qcs610 Firmware Version -
   Qualcomm ≫ Qcs610 Version -
Qualcomm ≫ Sd865 5g Firmware Version -
   Qualcomm ≫ Sd865 5g Version -
Qualcomm ≫ Sw5100 Firmware Version -
   Qualcomm ≫ Sw5100 Version -
Qualcomm ≫ Sw5100p Firmware Version -
   Qualcomm ≫ Sw5100p Version -
Qualcomm ≫ Sxr2130 Firmware Version -
   Qualcomm ≫ Sxr2130 Version -
Qualcomm ≫ Wcd9341 Firmware Version -
   Qualcomm ≫ Wcd9341 Version -
Qualcomm ≫ Wcd9370 Firmware Version -
   Qualcomm ≫ Wcd9370 Version -
Qualcomm ≫ Wcd9380 Firmware Version -
   Qualcomm ≫ Wcd9380 Version -
Qualcomm ≫ Wcn3660b Firmware Version -
   Qualcomm ≫ Wcn3660b Version -
Qualcomm ≫ Wcn3680b Firmware Version -
   Qualcomm ≫ Wcn3680b Version -
Qualcomm ≫ Wcn3950 Firmware Version -
   Qualcomm ≫ Wcn3950 Version -
Qualcomm ≫ Wcn3980 Firmware Version -
   Qualcomm ≫ Wcn3980 Version -
Qualcomm ≫ Wcn3988 Firmware Version -
   Qualcomm ≫ Wcn3988 Version -
Qualcomm ≫ Wsa8810 Firmware Version -
   Qualcomm ≫ Wsa8810 Version -
Qualcomm ≫ Wsa8815 Firmware Version -
   Qualcomm ≫ Wsa8815 Version -
Qualcomm ≫ Wsa8830 Firmware Version -
   Qualcomm ≫ Wsa8830 Version -
Qualcomm ≫ Wsa8835 Firmware Version -
   Qualcomm ≫ Wsa8835 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.023
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Qualcomm 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://www.qualcomm.com/company/product-security/bulletins/august-2023-bulletin
Patch
Vendor Advisory