Use After Free in Qualcomm products - CVE-2023-28577
Published: August 7, 2023
Vulnerability identifier: #VU79039
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-28577
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to no check if the buffer is being used in Camera Driver. A local privileged application can execute arbitrary code.
Affected software
Snapdragon XR2 5G Platform
WSA8835
WSA8830
WSA8815
WSA8810
WCN3988
WCN3980
WCN3950
WCN3680B
WCN3660B
WCD9380
WCD9370
WCD9341
SW5100P
SW5100
FastConnect 6800
Snapdragon X55 5G Modem-RF System
Snapdragon 870 5G Mobile Platform (SM8250-AC)
Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
Snapdragon 865 5G Mobile Platform
Snapdragon 8 Gen 1 Mobile Platform
SD865 5G
QCS610
QCS410
QCN9074
QCA6436
QCA6426
QCA6391
FastConnect 7800
FastConnect 6900
Pixel
SXR2130
WSA8835
WSA8830
WSA8815
WSA8810
WCN3988
WCN3980
WCN3950
WCN3680B
WCN3660B
WCD9380
WCD9370
WCD9341
SW5100P
SW5100
FastConnect 6800
Snapdragon X55 5G Modem-RF System
Snapdragon 870 5G Mobile Platform (SM8250-AC)
Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
Snapdragon 865 5G Mobile Platform
Snapdragon 8 Gen 1 Mobile Platform
SD865 5G
QCS610
QCS410
QCN9074
QCA6436
QCA6426
QCA6391
FastConnect 7800
FastConnect 6900
Pixel
SXR2130
How to mitigate CVE-2023-28577
Install security update from vendor's website.
Pixel - update to 2024-08-05