CVE-2023-28577

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.

Score

CVSS 3.1 7.8 High

Status

Modified - product-security@qualcomm.com

Published

2023-08-08

Last modified

2024-08-02

Weaknesses

CWE-416

Affected products

• Fastconnect 6800 Firmware (Qualcomm)
• Fastconnect 6900 Firmware (Qualcomm)
• Fastconnect 7800 Firmware (Qualcomm)
• Qca6391 Firmware (Qualcomm)
• Qca6426 Firmware (Qualcomm)
• Qca6436 Firmware (Qualcomm)
• Qcn9074 Firmware (Qualcomm)
• Qcs410 Firmware (Qualcomm)
• Qcs610 Firmware (Qualcomm)
• Sd865 5g Firmware (Qualcomm)
• Snapdragon 865+ 5g Firmware (Qualcomm)
• Snapdragon 865 5g Firmware (Qualcomm)
• Snapdragon 865 5g Mobile Platform Firmware (Qualcomm)
• Snapdragon 870 5g Firmware (Qualcomm)
• Snapdragon 8 Gen 1 Firmware (Qualcomm)
• Snapdragon 8 Gen 1 Mobile Platform Firmware (Qualcomm)
• Snapdragon X55 5g Firmware (Qualcomm)
• Snapdragon X55 5g Modem-rf System Firmware (Qualcomm)
• Snapdragon Xr2 5g Firmware (Qualcomm)
• Snapdragon Xr2 5g Platform Firmware (Qualcomm)
• Sw5100 Firmware (Qualcomm)
• Sw5100p Firmware (Qualcomm)
• Sxr2130 Firmware (Qualcomm)
• Wcd9341 Firmware (Qualcomm)
• Wcd9370 Firmware (Qualcomm)
• Wcd9380 Firmware (Qualcomm)
• Wcn3660b Firmware (Qualcomm)
• Wcn3680b Firmware (Qualcomm)
• Wcn3950 Firmware (Qualcomm)
• Wcn3980 Firmware (Qualcomm)
• Wcn3988 Firmware (Qualcomm)
• Wsa8810 Firmware (Qualcomm)
• Wsa8815 Firmware (Qualcomm)
• Wsa8830 Firmware (Qualcomm)
• Wsa8835 Firmware (Qualcomm)
• Snapdragon (Qualcomm Inc.)

References

• https://www.qualcomm.com/company/product-security/bulletins/august-2023-bulletin