In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.
2023-08-08T10:15:14.760
2024-11-21T07:55:34.353
Modified
CVSSv3.1: 6.7 (MEDIUM)