CVE-2023-28577

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
Qualcomm, Inc.SnapdragonFastConnect 6800; FastConnect 6900; FastConnect 7800; QCA6391; QCA6426; QCA6436; QCN9074; QCS410; QCS610; SD865 5G; Snapdragon 8 Gen 1 Mobile Platform; Snapdragon 865 5G Mobile Platform; Snapdragon 865+ 5G Mobile Platform (SM8250-AB); Snapdragon 870 5G Mobile Platform (SM8250-AC); Snapdragon X55 5G Modem-RF System; Snapdragon XR2 5G Platform; SW5100; SW5100P; SXR2130; WCD9341
qualcommfastconnect_6800_firmware<= *
qualcommfastconnect_6900_firmware<= *
qualcommfastconnect_7800_firmware<= *
qualcommqca6391_firmware<= *
qualcommqca6426_firmware<= *
qualcommqca6436_firmware<= *
qualcommqcn9074_firmware<= *
qualcommqcs410_firmware<= *
qualcommqcs610_firmware<= *
qualcommsd865_5g_firmware<= *
qualcommsnapdragon_8_gen_1_mobile_platform_firmware<= *
qualcommsnapdragon_865_5g_mobile_platform_firmware<= *
qualcommsnapdragon_x55_5g_modem-rf_system_firmware<= *
qualcommsnapdragon_xr2_5g_platform_firmware<= *
qualcommsw5100_firmware<= *
qualcommsw5100p_firmware<= *
qualcommsxr2130_firmware<= *
qualcommwcd9341_firmware<= *
qualcommwcd9370_firmware<= *
qualcommwcd9380_firmware<= *
qualcommwcn3660b_firmware<= *
qualcommwcn3680b_firmware<= *
qualcommwcn3950_firmware<= *
qualcommwcn3980_firmware<= *
qualcommwcn3988_firmware<= *
qualcommwsa8810_firmware<= *
qualcommwsa8815_firmware<= *
qualcommwsa8830_firmware<= *
qualcommwsa8835_firmware<= *

References

Timeline

Published
Aug 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-285787.8Memory corruption in Core Services while executing the command for removing a single event listener.CVE-2023-285797.8Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.CVE-2023-28586.5NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileCVE-2023-285807.8Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.CVE-2023-285819.8Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.CVE-2023-285829.8Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.CVE-2023-285837.8Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.CVE-2023-285847.5Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).CVE-2023-285858.8Memory corruption while loading an ELF segment in TEE Kernel.CVE-2023-285866.5Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.CVE-2023-285877.8Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.CVE-2023-285887.5Transient DOS in Bluetooth Host while rfc slot allocation.
CVE-2023-28577: High severity, CVSS 7.8 | Vulnix