CVE-2023-28577 | BDVDB-2026-208949 Detail

Description#

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12023-08-08Record published in the CVE List.
2. Version 22024-08-02Most recent update recorded in the CVE List.