Description (CNA)
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Qualcomm, Inc. / Snapdragon | affected FastConnect 6800; affected FastConnect 6900; affected FastConnect 7800; affected QCA6391; affected QCA6426; affected QCA6436; affected QCN9074; affected QCS410; affected QCS610; affected SD865 5G; affected Snapdragon 8 Gen 1 Mobile Platform; affected Snapdragon 865 5G Mobile Platform; affected Snapdragon 865+ 5G Mobile Platform (SM8250-AB); affected Snapdragon 870 5G Mobile Platform (SM8250-AC); affected Snapdragon X55 5G Modem-RF System; affected Snapdragon XR2 5G Platform; affected SW5100; affected SW5100P; affected SXR2130; affected WCD9341; affected WCD9370; affected WCD9380; affected WCN3660B; affected WCN3680B; affected WCN3950; affected WCN3980; affected WCN3988; affected WSA8810; affected WSA8815; affected WSA8830; affected WSA8835 |
CWE
CWE-416
References
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.