PT-2023-21825 · Qualcomm · Snapdragon+29

Published

2023-08-08

·

Updated

2024-04-12

·

CVE-2023-28576

CVSS v3.1

6.4

Medium

VectorAV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.
Description The issue involves kernel APIs, such as cam mem get cpu buf(), where a buffer may remain readable and writable in userspace after being accessed by the kernel. This can lead to a race condition where user mode modifies the packet header, for example, header.count, causing kernel code checks, like size checks, to become invalid. As a result, this may lead to out-of-bounds read/write issues.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2023-28576

Affected Products

Snapdragon
Fastconnect 6800 Firmware
Fastconnect 6900 Firmware
Fastconnect 7800 Firmware
Qca6391 Firmware
Qca6426 Firmware
Qca6436 Firmware
Qcn9074 Firmware
Qcs410 Firmware
Qcs610 Firmware
Sd865 5G Firmware
Snapdragon 865 5G Firmware
Snapdragon 870 5G Firmware
Snapdragon 8 Gen 1 Firmware
Snapdragon X55 5G Firmware
Snapdragon Xr2 5G Firmware
Sw5100P Firmware
Sxr2130 Firmware
Wcd9341 Firmware
Wcd9370 Firmware
Wcd9380 Firmware
Wcn3660B Firmware
Wcn3680B Firmware
Wcn3950 Firmware
Wcn3980 Firmware
Wcn3988 Firmware
Wsa8810 Firmware
Wsa8815 Firmware
Wsa8830 Firmware
Wsa8835 Firmware