Non notée
CVE-2020-0232 Function abc_pcie_issue_dma_xfer_sync creates a transfer object, adds it to the session object then continues to work…
Description
Function abc_pcie_issue_dma_xfer_sync creates a transfer object, adds it to the session object then continues to work with it. A concurrent thread could retrieve created transfer object from the session object and delete it using abc_pcie_dma_user_xfer_clean. If this happens, abc_pcie_start_dma_xfer and abc_pcie_wait_dma_xfer in the original thread will trigger UAF when working with the transfer object.Product: AndroidVersions: Android kernelAndroid ID: A-151453714
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Android | Versions non publiées |
Autres CVE de Android
Les 2441 CVE de Android →
CVE-2023-21167
In setProfileName of DevicePolicyManagerService.java, there is a possible way to crash the SystemUI menu due to a…
Non notée
CVE-2023-21168
In convertCbYCrY of ColorConverter.cpp, there is a possible out of bounds read due to a missing bounds check
Non notée
CVE-2023-21170
In executeSetClientTarget of ComposerCommandEngine.h, there is a possible out of bounds read due to a missing bounds…
Non notée
CVE-2023-21169
In inviteInternal of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check
Non notée