adsprpc: Handle UAF scenario in put_args
Currently, the DSP updates header buffers with unused DMA handle fds. In the put_args section, if any DMA handle FDs are present in the header buffer, the corresponding map is freed. However, since the header buffer is exposed to users in unsigned PD, users can update invalid FDs. If this invalid FD matches with any FD that is already in use, it could lead to a use-after-free (UAF) vulnerability. As a solution,add DMA handle references for DMA FDs, and the map for the FD will be freed only when a reference is found. Acked-by:Om Deore <quic_odeore@quicinc.com> Change-Id: I3c2614451f7b3717236708ee5e9b88f16f6e435d Signed-off-by:
Santosh <quic_ssakore@quicinc.com>
Loading
-
mentioned in commit 98bae7fa
-
mentioned in commit be6d4fb1
-
mentioned in commit 1b490112
-
mentioned in commit 9fceddef
-
mentioned in commit 724c13e0
-
mentioned in commit 18c29b2e
-
mentioned in commit eb0d5e83
-
mentioned in commit 2354cfca
-
mentioned in commit 3e206c9f
-
mentioned in commit 50acf2fb
-
mentioned in commit ebeda931
-
mentioned in commit 25aa4c7e
Please sign in to comment