Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggered and callback instance is deleted in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Apq8017 | Qualcomm | - (including) | - (including) |
| Apq8053 | Qualcomm | - (including) | - (including) |
| Msm8917 | Qualcomm | - (including) | - (including) |
| Msm8953 | Qualcomm | - (including) | - (including) |
| Pm215 | Qualcomm | - (including) | - (including) |
| Pm3003a | Qualcomm | - (including) | - (including) |
| Pm439 | Qualcomm | - (including) | - (including) |
| Pm6125 | Qualcomm | - (including) | - (including) |
| Pm6150 | Qualcomm | - (including) | - (including) |
| Pm6150a | Qualcomm | - (including) | - (including) |
| Pm6150l | Qualcomm | - (including) | - (including) |
| Pm6350 | Qualcomm | - (including) | - (including) |
| Pm640a | Qualcomm | - (including) | - (including) |
| Pm640l | Qualcomm | - (including) | - (including) |
| Pm640p | Qualcomm | - (including) | - (including) |
| Pm660 | Qualcomm | - (including) | - (including) |
| Pm660l | Qualcomm | - (including) | - (including) |
| Pm670 | Qualcomm | - (including) | - (including) |
| Pm670l | Qualcomm | - (including) | - (including) |
| Pm7150a | Qualcomm | - (including) | - (including) |
| Pm7150l | Qualcomm | - (including) | - (including) |
| Pm7250 | Qualcomm | - (including) | - (including) |
| Pm7250b | Qualcomm | - (including) | - (including) |
| Pm7350c | Qualcomm | - (including) | - (including) |
| Pm8008 | Qualcomm | - (including) | - (including) |
| Pm8009 | Qualcomm | - (including) | - (including) |
| Pm8150a | Qualcomm | - (including) | - (including) |
| Pm8150b | Qualcomm | - (including) | - (including) |
| Pm8150c | Qualcomm | - (including) | - (including) |
| Pm8150l | Qualcomm | - (including) | - (including) |
| Pm8250 | Qualcomm | - (including) | - (including) |
| Pm8350 | Qualcomm | - (including) | - (including) |
| Pm8350b | Qualcomm | - (including) | - (including) |
| Pm8350bh | Qualcomm | - (including) | - (including) |
| Pm8350bhs | Qualcomm | - (including) | - (including) |
| Pm8350c | Qualcomm | - (including) | - (including) |
| Pm855 | Qualcomm | - (including) | - (including) |
| Pm855b | Qualcomm | - (including) | - (including) |
| Pm855l | Qualcomm | - (including) | - (including) |
| Pm8916 | Qualcomm | - (including) | - (including) |
| Pm8937 | Qualcomm | - (including) | - (including) |
| Pm8953 | Qualcomm | - (including) | - (including) |
| Pmi632 | Qualcomm | - (including) | - (including) |
| Pmi8937 | Qualcomm | - (including) | - (including) |
| Pmi8952 | Qualcomm | - (including) | - (including) |
| Pmk7350 | Qualcomm | - (including) | - (including) |
| Pmk8002 | Qualcomm | - (including) | - (including) |
| Pmk8003 | Qualcomm | - (including) | - (including) |
| Pmk8350 | Qualcomm | - (including) | - (including) |
| Pmm8195au | Qualcomm | - (including) | - (including) |
| Pmm855au | Qualcomm | - (including) | - (including) |
| Pmr525 | Qualcomm | - (including) | - (including) |
| Pmr735a | Qualcomm | - (including) | - (including) |
| Pmr735b | Qualcomm | - (including) | - (including) |
| Pmx55 | Qualcomm | - (including) | - (including) |
| Qat3514 | Qualcomm | - (including) | - (including) |
| Qat3516 | Qualcomm | - (including) | - (including) |
| Qat3518 | Qualcomm | - (including) | - (including) |
| Qat3519 | Qualcomm | - (including) | - (including) |
| Qat3522 | Qualcomm | - (including) | - (including) |
| Qat3550 | Qualcomm | - (including) | - (including) |
| Qat3555 | Qualcomm | - (including) | - (including) |
| Qat5515 | Qualcomm | - (including) | - (including) |
| Qat5516 | Qualcomm | - (including) | - (including) |
| Qat5522 | Qualcomm | - (including) | - (including) |
| Qat5533 | Qualcomm | - (including) | - (including) |
| Qat5568 | Qualcomm | - (including) | - (including) |
| Qbt1500 | Qualcomm | - (including) | - (including) |
| Qbt2000 | Qualcomm | - (including) | - (including) |
| Qca6390 | Qualcomm | - (including) | - (including) |
| Qca6391 | Qualcomm | - (including) | - (including) |
| Qca6421 | Qualcomm | - (including) | - (including) |
| Qca6426 | Qualcomm | - (including) | - (including) |
| Qca6431 | Qualcomm | - (including) | - (including) |
| Qca6436 | Qualcomm | - (including) | - (including) |
| Qca6574a | Qualcomm | - (including) | - (including) |
| Qca6574au | Qualcomm | - (including) | - (including) |
| Qca6595 | Qualcomm | - (including) | - (including) |
| Qca6595au | Qualcomm | - (including) | - (including) |
| Qca6696 | Qualcomm | - (including) | - (including) |
| Qcs605 | Qualcomm | - (including) | - (including) |
| Qdm2301 | Qualcomm | - (including) | - (including) |
| Qdm2302 | Qualcomm | - (including) | - (including) |
| Qdm2305 | Qualcomm | - (including) | - (including) |
| Qdm2307 | Qualcomm | - (including) | - (including) |
| Qdm2308 | Qualcomm | - (including) | - (including) |
| Qdm2310 | Qualcomm | - (including) | - (including) |
| Qdm3301 | Qualcomm | - (including) | - (including) |
| Qdm3302 | Qualcomm | - (including) | - (including) |
| Qdm4643 | Qualcomm | - (including) | - (including) |
| Qdm4650 | Qualcomm | - (including) | - (including) |
| Qdm5579 | Qualcomm | - (including) | - (including) |
| Qdm5620 | Qualcomm | - (including) | - (including) |
| Qdm5621 | Qualcomm | - (including) | - (including) |
| Qdm5650 | Qualcomm | - (including) | - (including) |
| Qdm5652 | Qualcomm | - (including) | - (including) |
| Qdm5670 | Qualcomm | - (including) | - (including) |
| Qdm5671 | Qualcomm | - (including) | - (including) |
| Qdm5677 | Qualcomm | - (including) | - (including) |
| Qdm5679 | Qualcomm | - (including) | - (including) |
| Qet4101 | Qualcomm | - (including) | - (including) |
| Qet5100 | Qualcomm | - (including) | - (including) |
| Qet5100m | Qualcomm | - (including) | - (including) |
| Qet6100 | Qualcomm | - (including) | - (including) |
| Qet6110 | Qualcomm | - (including) | - (including) |
| Qfe2101 | Qualcomm | - (including) | - (including) |
| Qfe2520 | Qualcomm | - (including) | - (including) |
| Qfe2550 | Qualcomm | - (including) | - (including) |
| Qfe3340 | Qualcomm | - (including) | - (including) |
| Qfe4301 | Qualcomm | - (including) | - (including) |
| Qfe4302 | Qualcomm | - (including) | - (including) |
| Qfe4303 | Qualcomm | - (including) | - (including) |
| Qfe4305 | Qualcomm | - (including) | - (including) |
| Qfe4308 | Qualcomm | - (including) | - (including) |
| Qfe4309 | Qualcomm | - (including) | - (including) |
| Qfe4320 | Qualcomm | - (including) | - (including) |
| Qfe4373fc | Qualcomm | - (including) | - (including) |
| Qfs2530 | Qualcomm | - (including) | - (including) |
| Qfs2580 | Qualcomm | - (including) | - (including) |
| Qfs2608 | Qualcomm | - (including) | - (including) |
| Qfs2630 | Qualcomm | - (including) | - (including) |
| Qln4642 | Qualcomm | - (including) | - (including) |
| Qln4650 | Qualcomm | - (including) | - (including) |
| Qln5020 | Qualcomm | - (including) | - (including) |
| Qln5030 | Qualcomm | - (including) | - (including) |
| Qln5040 | Qualcomm | - (including) | - (including) |
| Qpa2625 | Qualcomm | - (including) | - (including) |
| Qpa4360 | Qualcomm | - (including) | - (including) |
| Qpa4361 | Qualcomm | - (including) | - (including) |
| Qpa5373 | Qualcomm | - (including) | - (including) |
| Qpa5461 | Qualcomm | - (including) | - (including) |
| Qpa5580 | Qualcomm | - (including) | - (including) |
| Qpa5581 | Qualcomm | - (including) | - (including) |
| Qpa6560 | Qualcomm | - (including) | - (including) |
| Qpa8673 | Qualcomm | - (including) | - (including) |
| Qpa8686 | Qualcomm | - (including) | - (including) |
| Qpa8801 | Qualcomm | - (including) | - (including) |
| Qpa8802 | Qualcomm | - (including) | - (including) |
| Qpa8803 | Qualcomm | - (including) | - (including) |
| Qpa8821 | Qualcomm | - (including) | - (including) |
| Qpa8842 | Qualcomm | - (including) | - (including) |
| Qpm4621 | Qualcomm | - (including) | - (including) |
| Qpm4630 | Qualcomm | - (including) | - (including) |
| Qpm4640 | Qualcomm | - (including) | - (including) |
| Qpm4641 | Qualcomm | - (including) | - (including) |
| Qpm4650 | Qualcomm | - (including) | - (including) |
| Qpm5621 | Qualcomm | - (including) | - (including) |
| Qpm5641 | Qualcomm | - (including) | - (including) |
| Qpm5658 | Qualcomm | - (including) | - (including) |
| Qpm5670 | Qualcomm | - (including) | - (including) |
| Qpm5677 | Qualcomm | - (including) | - (including) |
| Qpm5679 | Qualcomm | - (including) | - (including) |
| Qpm5870 | Qualcomm | - (including) | - (including) |
| Qpm5875 | Qualcomm | - (including) | - (including) |
| Qpm6582 | Qualcomm | - (including) | - (including) |
| Qpm6585 | Qualcomm | - (including) | - (including) |
| Qpm6621 | Qualcomm | - (including) | - (including) |
| Qpm6670 | Qualcomm | - (including) | - (including) |
| Qpm8820 | Qualcomm | - (including) | - (including) |
| Qpm8830 | Qualcomm | - (including) | - (including) |
| Qpm8870 | Qualcomm | - (including) | - (including) |
| Qpm8895 | Qualcomm | - (including) | - (including) |
| Qsm7250 | Qualcomm | - (including) | - (including) |
| Qsw6310 | Qualcomm | - (including) | - (including) |
| Qsw8573 | Qualcomm | - (including) | - (including) |
| Qsw8574 | Qualcomm | - (including) | - (including) |
| Qtc410s | Qualcomm | - (including) | - (including) |
| Qtc800h | Qualcomm | - (including) | - (including) |
| Qtc801s | Qualcomm | - (including) | - (including) |
| Qtm525 | Qualcomm | - (including) | - (including) |
| Qualcomm215 | Qualcomm | - (including) | - (including) |
| Sa6155p | Qualcomm | - (including) | - (including) |
| Sa8150p | Qualcomm | - (including) | - (including) |
| Sa8155 | Qualcomm | - (including) | - (including) |
| Sa8195p | Qualcomm | - (including) | - (including) |
| Sd429 | Qualcomm | - (including) | - (including) |
| Sd439 | Qualcomm | - (including) | - (including) |
| Sd632 | Qualcomm | - (including) | - (including) |
| Sd665 | Qualcomm | - (including) | - (including) |
| Sd675 | Qualcomm | - (including) | - (including) |
| Sd6905g | Qualcomm | - (including) | - (including) |
| Sd750g | Qualcomm | - (including) | - (including) |
| Sd765 | Qualcomm | - (including) | - (including) |
| Sd765g | Qualcomm | - (including) | - (including) |
| Sd768g | Qualcomm | - (including) | - (including) |
| Sd855 | Qualcomm | - (including) | - (including) |
| Sd8655g | Qualcomm | - (including) | - (including) |
| Sd8885g | Qualcomm | - (including) | - (including) |
| Sda429w | Qualcomm | - (including) | - (including) |
| Sdm429w | Qualcomm | - (including) | - (including) |
| Sdr660 | Qualcomm | - (including) | - (including) |
| Sdr660g | Qualcomm | - (including) | - (including) |
| Sdr735 | Qualcomm | - (including) | - (including) |
| Sdr735g | Qualcomm | - (including) | - (including) |
| Sdr8250 | Qualcomm | - (including) | - (including) |
| Sdr865 | Qualcomm | - (including) | - (including) |
| Sdx55 | Qualcomm | - (including) | - (including) |
| Sdx55m | Qualcomm | - (including) | - (including) |
| Sdxr1 | Qualcomm | - (including) | - (including) |
| Sdxr25g | Qualcomm | - (including) | - (including) |
| Sm7250p | Qualcomm | - (including) | - (including) |
| Sm7350 | Qualcomm | - (including) | - (including) |
| Smb1351 | Qualcomm | - (including) | - (including) |
| Smb1355 | Qualcomm | - (including) | - (including) |
| Smb1358 | Qualcomm | - (including) | - (including) |
| Smb1360 | Qualcomm | - (including) | - (including) |
| Smb1381 | Qualcomm | - (including) | - (including) |
| Smb1390 | Qualcomm | - (including) | - (including) |
| Smb1394 | Qualcomm | - (including) | - (including) |
| Smb1395 | Qualcomm | - (including) | - (including) |
| Smb1396 | Qualcomm | - (including) | - (including) |
| Smb1398 | Qualcomm | - (including) | - (including) |
| Smr525 | Qualcomm | - (including) | - (including) |
| Smr526 | Qualcomm | - (including) | - (including) |
| Smr545 | Qualcomm | - (including) | - (including) |
| Smr546 | Qualcomm | - (including) | - (including) |
| Wcd9326 | Qualcomm | - (including) | - (including) |
| Wcd9341 | Qualcomm | - (including) | - (including) |
| Wcd9370 | Qualcomm | - (including) | - (including) |
| Wcd9375 | Qualcomm | - (including) | - (including) |
| Wcd9380 | Qualcomm | - (including) | - (including) |
| Wcd9385 | Qualcomm | - (including) | - (including) |
| Wcn3610 | Qualcomm | - (including) | - (including) |
| Wcn3615 | Qualcomm | - (including) | - (including) |
| Wcn3620 | Qualcomm | - (including) | - (including) |
| Wcn3660b | Qualcomm | - (including) | - (including) |
| Wcn3680 | Qualcomm | - (including) | - (including) |
| Wcn3680b | Qualcomm | - (including) | - (including) |
| Wcn3950 | Qualcomm | - (including) | - (including) |
| Wcn3980 | Qualcomm | - (including) | - (including) |
| Wcn3988 | Qualcomm | - (including) | - (including) |
| Wcn3990 | Qualcomm | - (including) | - (including) |
| Wcn3991 | Qualcomm | - (including) | - (including) |
| Wcn3998 | Qualcomm | - (including) | - (including) |
| Wcn6740 | Qualcomm | - (including) | - (including) |
| Wcn6850 | Qualcomm | - (including) | - (including) |
| Wcn6851 | Qualcomm | - (including) | - (including) |
| Wcn6856 | Qualcomm | - (including) | - (including) |
| Wgr7640 | Qualcomm | - (including) | - (including) |
| Wsa8810 | Qualcomm | - (including) | - (including) |
| Wsa8815 | Qualcomm | - (including) | - (including) |
| Wsa8830 | Qualcomm | - (including) | - (including) |
| Wsa8835 | Qualcomm | - (including) | - (including) |
| Wtr2955 | Qualcomm | - (including) | - (including) |
| Wtr2965 | Qualcomm | - (including) | - (including) |
| Wtr3925 | Qualcomm | - (including) | - (including) |
The use of previously-freed memory can have any number of adverse consequences, ranging from the corruption of valid data to the execution of arbitrary code, depending on the instantiation and timing of the flaw. The simplest way data corruption may occur involves the system’s reuse of the freed memory. Use-after-free errors have two common and sometimes overlapping causes:
In this scenario, the memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.