CVE-2017-7364
CriticalSummary
In Qualcomm products with Android releases from CAF, in the function __mdss_fb_copy_destscaler_data(), the variable ds_data[i].scale may point to a user-provided address. In the event of an error, this address may be freed, leading to a use after free condition.
Risk Assessment
The organization may be exposed to attacks that exploit the use after free condition, potentially allowing unauthorized access to kernel memory and control over the system.
Recommendation
It is recommended to update Qualcomm products to the latest versions that mitigate this vulnerability and to monitor systems for unusual behavior.
Original NVD description (English source)
In all Qualcomm products with Android releases from CAF using the Linux kernel, in function __mdss_fb_copy_destscaler_data(), variable ds_data[i].scale may still point to a user-provided address (which could point to arbitrary kernel address), so on an error condition, this user-provided address will be freed (arbitrary free), and continued operation could result in use after free condition.