CVE-2023-28577 — Multiple Dmabuf Kernel Address UAF Vulnerability
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use,…
Published: 2023-08-08 · CVSS: 6.7 · CVSS 3.1
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7