413 matches found
CVE-2023-22383
Memory Corruption in camera while installing a fd for a particular DMA buffer...
Memory corruption
Memory Corruption in camera while installing a fd for a particular DMA buffer...
CVE-2023-22383 Use After Free in Camera
Memory Corruption in camera while installing a fd for a particular DMA buffer...
CVE-2023-22383
CVE-2023-22383 affects Qualcomm Chipsets, with memory corruption in the camera path when installing a file descriptor for a specific DMA buffer. Affected component is the camera subsystem (Qualcomm hardware/CAM driver). Root cause details are limited in the provided documents, but the CVE is list...
CVE-2023-6238 Kernel: nvme: memory corruption via unprivileged user passthrough
A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...
kernel: drm/shmem-helper: Remove another errant put in error path
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drmgemshmemmmap doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free...
kernel: drm/shmem-helper: Remove another errant put in error path
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drmgemshmemmmap doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free...
kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data-block0" variable was not limited to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dmabuffer. This issue could allow a local...
CVE-2023-28541
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data...
Memory corruption
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data...
CVE-2023-28541 Buffer Over-read in WLAN Host
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data...
CVE-2023-28541 Buffer Over-read in WLAN Host
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data...
kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data-block0" variable was not limited to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dmabuffer. This issue could allow a local...
Qualcomm Adreno/KGSL Unchecked Cast / Type Confusion
Qualcomm Adreno/KGSL: unchecked cast of vma-vmfile-privatedata in kgslsetupdmabufuseraddr Tested on a Pixel 4 flame, on the latest update from 2023-02, which self-reports as SPL 2022-10-05, since I don't yet have any newer device with KGSL here - but as far as I can tell from the sources, it shou...
kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free
A use-after-free vulnerability was found in the Linux kernel Intel i915 graphics driver's GuC virtual engine request handling. A local user with access to GPU rendering can create requests on GuC virtual engines and trap references via syncfile or dmabuf, causing fence release operations to acces...
CVE-2023-20717
In vcu, there is a possible leak of dma buffer due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645185; Issue ID: ALPS07645185...
CVE-2023-20717
In vcu, there is a possible leak of dma buffer due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645185; Issue ID: ALPS07645185...
Race condition
In vcu, there is a possible leak of dma buffer due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645185; Issue ID: ALPS07645185...
PT-2023-17580 · Vcu · Vcu
Name of the Vulnerable Software and Affected Versions: vcu affected versions not specified Description: The issue is related to a possible leak of DMA buffer due to a race condition, which could lead to local information disclosure. System execution privileges are needed for exploitation, and use...
CVE-2023-20717
In vcu, there is a possible leak of dma buffer due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645185; Issue ID: ALPS07645185...