Time-of-check Time-of-use (TOCTOU) Race Condition in Qualcomm products - CVE-2023-28576
Published: August 7, 2023
Vulnerability identifier: #VU79038
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-28576
CWE-ID: CWE-367
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera Kernel Driver. A local privileged application can execute arbitrary code.
Affected software
Snapdragon XR2 5G Platform
WSA8835
WSA8830
WSA8815
WSA8810
WCN3988
WCN3980
WCN3950
WCN3680B
WCN3660B
WCD9380
WCD9370
WCD9341
SW5100P
SW5100
FastConnect 6800
Snapdragon X55 5G Modem-RF System
Snapdragon 870 5G Mobile Platform (SM8250-AC)
Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
Snapdragon 865 5G Mobile Platform
Snapdragon 8 Gen 1 Mobile Platform
SD865 5G
QCS610
QCS410
QCN9074
QCA6436
QCA6426
QCA6391
FastConnect 7800
FastConnect 6900
SXR2130
WSA8835
WSA8830
WSA8815
WSA8810
WCN3988
WCN3980
WCN3950
WCN3680B
WCN3660B
WCD9380
WCD9370
WCD9341
SW5100P
SW5100
FastConnect 6800
Snapdragon X55 5G Modem-RF System
Snapdragon 870 5G Mobile Platform (SM8250-AC)
Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
Snapdragon 865 5G Mobile Platform
Snapdragon 8 Gen 1 Mobile Platform
SD865 5G
QCS610
QCS410
QCN9074
QCA6436
QCA6426
QCA6391
FastConnect 7800
FastConnect 6900
SXR2130
How to mitigate CVE-2023-28576
Install security update from vendor's website.