high
7.8
CWE
416
Advisory Published
Updated

CVE-2023-28577: Multiple Dmabuf Kernel Address UAF Vulnerability

First published: Tue Aug 08 2023(Updated: )

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.

Credit: product-security@qualcomm.com

Affected SoftwareAffected VersionHow to fix
All of
Qualcomm FastConnect 6800 Firmware
Qualcomm FastConnect 6800 Firmware
All of
Qualcomm FastConnect 6900 Firmware
Qualcomm Fastconnect 6900 Firmware
All of
Qualcomm Fastconnect 7800 Firmware
Qualcomm Fastconnect 7800 Firmware
All of
Qualcomm QCA6391 Firmware
Qualcomm QCA6391 Firmware
All of
Qualcomm QCA6426 Firmware
Qualcomm QCA6426 Firmware
All of
Qualcomm QCA6436 Firmware
Qualcomm QCA6436 Firmware
All of
Qualcomm QCN9074 Firmware
Qualcomm QCN9074 Firmware
All of
Qualcomm QCS410 Firmware
Qualcomm QCS410 Firmware
All of
Qualcomm QCS610 Firmware
Qualcomm QCS610 Firmware
All of
Qualcomm Snapdragon 865 5G Firmware
Qualcomm Snapdragon 865 5G Firmware
All of
Qualcomm Snapdragon 8 Gen 1 Mobile Firmware
Qualcomm Snapdragon 8 Gen 1 Mobile Firmware
All of
Qualcomm Snapdragon 865 5G Mobile Firmware
Qualcomm Snapdragon 865 5G Mobile
All of
Qualcomm Snapdragon 865+ 5G Firmware
Qualcomm Snapdragon 865
All of
Qualcomm Snapdragon 870 Firmware
Qualcomm Snapdragon 870
All of
Qualcomm Snapdragon X55 Firmware
Qualcomm Snapdragon X55 Firmware
All of
Qualcomm Snapdragon XR2 5G Platform Firmware
Qualcomm Snapdragon XR2 5G
All of
Qualcomm SW5100P
Qualcomm SW5100P
All of
Qualcomm SW5100 Firmware
Qualcomm SW5100 Firmware
All of
qualcomm SXR2130P firmware
Qualcomm SXR2130
All of
Qualcomm WCD9341
Qualcomm WCD9341 Firmware
All of
Qualcomm WCD9370 Firmware
Qualcomm WCD9370 Firmware
All of
Qualcomm WCD9380
Qualcomm WCD9380 Firmware
All of
Qualcomm WCN3660B
Qualcomm WCN3660B Firmware
All of
Qualcomm WCN3680B Firmware
Qualcomm WCN3680B Firmware
All of
Qualcomm WCN3950 Firmware
Qualcomm WCN3950 Firmware
All of
Qualcomm Wcn3980
qualcomm wcn3980 firmware
All of
qualcomm wcn3988 firmware
Qualcomm WCN3988
All of
Qualcomm WSA8810
Qualcomm WSA8810 Firmware
All of
qualcomm wsa8815 firmware
qualcomm wsa8815 firmware
All of
Qualcomm WSA8830
Qualcomm WSA8830
All of
Qualcomm WSA8835
Qualcomm WSA8835 Firmware
Qualcomm FastConnect 6800 Firmware
Qualcomm FastConnect 6800 Firmware
Qualcomm FastConnect 6900 Firmware
Qualcomm Fastconnect 6900 Firmware
Qualcomm Fastconnect 7800 Firmware
Qualcomm Fastconnect 7800 Firmware
Qualcomm QCA6391 Firmware
Qualcomm QCA6391 Firmware
Qualcomm QCA6426 Firmware
Qualcomm QCA6426 Firmware
Qualcomm QCA6436 Firmware
Qualcomm QCA6436 Firmware
Qualcomm QCN9074 Firmware
Qualcomm QCN9074 Firmware
Qualcomm QCS410 Firmware
Qualcomm QCS410 Firmware
Qualcomm QCS610 Firmware
Qualcomm QCS610 Firmware
Qualcomm Snapdragon 865 5G Firmware
Qualcomm Snapdragon 865 5G Firmware
Qualcomm Snapdragon 8 Gen 1 Mobile Firmware
Qualcomm Snapdragon 8 Gen 1 Mobile Firmware
Qualcomm Snapdragon 865 5G Mobile Firmware
Qualcomm Snapdragon 865 5G Mobile
Qualcomm Snapdragon 865+ 5G Firmware
Qualcomm Snapdragon 865
Qualcomm Snapdragon 870 Firmware
Qualcomm Snapdragon 870
Qualcomm Snapdragon X55 Firmware
Qualcomm Snapdragon X55 Firmware
Qualcomm Snapdragon XR2 5G Platform Firmware
Qualcomm Snapdragon XR2 5G
Qualcomm SW5100P
Qualcomm SW5100P
Qualcomm SW5100 Firmware
Qualcomm SW5100 Firmware
qualcomm SXR2130P firmware
Qualcomm SXR2130
Qualcomm WCD9341
Qualcomm WCD9341 Firmware
Qualcomm WCD9370 Firmware
Qualcomm WCD9370 Firmware
Qualcomm WCD9380
Qualcomm WCD9380 Firmware
Qualcomm WCN3660B
Qualcomm WCN3660B Firmware
Qualcomm WCN3680B Firmware
Qualcomm WCN3680B Firmware
Qualcomm WCN3950 Firmware
Qualcomm WCN3950 Firmware
Qualcomm Wcn3980
qualcomm wcn3980 firmware
qualcomm wcn3988 firmware
Qualcomm WCN3988
Qualcomm WSA8810
Qualcomm WSA8810 Firmware
qualcomm wsa8815 firmware
qualcomm wsa8815 firmware
Qualcomm WSA8830
Qualcomm WSA8830
Qualcomm WSA8835
Qualcomm WSA8835 Firmware

Remedy

https://www.qualcomm.com/company/product-security/bulletins/august-2023-bulletin

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID for this vulnerability?

    The vulnerability ID for this vulnerability is CVE-2023-28577.

  • What is the severity of CVE-2023-28577?

    The severity of CVE-2023-28577 is high with a severity value of 7.8.

  • Which software is affected by CVE-2023-28577?

    Qualcomm Fastconnect 6800 Firmware, Qualcomm Fastconnect 6900 Firmware, Qualcomm Fastconnect 7800 Firmware, Qualcomm Qca6426 Firmware, Qualcomm Qca6436, Qualcomm Wcd9341 Firmware, Qualcomm Wcd9370 Firmware, Qualcomm Wcd9380, Qualcomm Sxr2130 Firmware, and Google Android are affected by CVE-2023-28577.

  • What is the description of CVE-2023-28577?

    In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used, allowing another thread to unmap the kernel va and causing a use-after-free (UAF) of the kernel address.

  • Where can I find more information about CVE-2023-28577?

    You can find more information about CVE-2023-28577 on the Qualcomm Product Security Bulletin for August 2023.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203