CVE-2023-28576
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2023
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel Driver
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Snapdragon
- Vendor
- Qualcomm, Inc.
- Product
- Snapdragon
- Platforms
- Snapdragon Compute
- Snapdragon Consumer IOT
- Snapdragon Industrial IOT
- Snapdragon Mobile
- Snapdragon Wearables
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| FastConnect 6800 | affected | Unavailable | Unavailable | Unavailable | None listed |
| FastConnect 6900 | affected | Unavailable | Unavailable | Unavailable | None listed |
| FastConnect 7800 | affected | Unavailable | Unavailable | Unavailable | None listed |
| QCA6391 | affected | Unavailable | Unavailable | Unavailable | None listed |
| QCA6426 | affected | Unavailable | Unavailable | Unavailable | None listed |
| QCA6436 | affected | Unavailable | Unavailable | Unavailable | None listed |
| QCN9074 | affected | Unavailable | Unavailable | Unavailable | None listed |
| QCS410 | affected | Unavailable | Unavailable | Unavailable | None listed |
| QCS610 | affected | Unavailable | Unavailable | Unavailable | None listed |
| SD865 5G | affected | Unavailable | Unavailable | Unavailable | None listed |
| Snapdragon 8 Gen 1 Mobile Platform | affected | Unavailable | Unavailable | Unavailable | None listed |
| Snapdragon 865 5G Mobile Platform | affected | Unavailable | Unavailable | Unavailable | None listed |
| Snapdragon 865+ 5G Mobile Platform (SM8250-AB) | affected | Unavailable | Unavailable | Unavailable | None listed |
| Snapdragon 870 5G Mobile Platform (SM8250-AC) | affected | Unavailable | Unavailable | Unavailable | None listed |
| Snapdragon X55 5G Modem-RF System | affected | Unavailable | Unavailable | Unavailable | None listed |
| Snapdragon XR2 5G Platform | affected | Unavailable | Unavailable | Unavailable | None listed |
| SW5100 | affected | Unavailable | Unavailable | Unavailable | None listed |
| SW5100P | affected | Unavailable | Unavailable | Unavailable | None listed |
| SXR2130 | affected | Unavailable | Unavailable | Unavailable | None listed |
| WCD9341 | affected | Unavailable | Unavailable | Unavailable | None listed |
| WCD9370 | affected | Unavailable | Unavailable | Unavailable | None listed |
| WCD9380 | affected | Unavailable | Unavailable | Unavailable | None listed |
| WCN3660B | affected | Unavailable | Unavailable | Unavailable | None listed |
| WCN3680B | affected | Unavailable | Unavailable | Unavailable | None listed |
| WCN3950 | affected | Unavailable | Unavailable | Unavailable | None listed |
| WCN3980 | affected | Unavailable | Unavailable | Unavailable | None listed |
| WCN3988 | affected | Unavailable | Unavailable | Unavailable | None listed |
| WSA8810 | affected | Unavailable | Unavailable | Unavailable | None listed |
| WSA8815 | affected | Unavailable | Unavailable | Unavailable | None listed |
| WSA8830 | affected | Unavailable | Unavailable | Unavailable | None listed |
| WSA8835 | affected | Unavailable | Unavailable | Unavailable | None listed |