In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Un-trusted pointer de-reference issue by accessing a variable which is already freed.
An unprivileged user can issue a binder call and cause a system halt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150
In ADSP RPC in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, a Use After Free condition can occur in versions MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDX20.
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, A use after free condition and an out-of-bounds access can occur in the DIAG driver.
Crafted Binder Request Causes Heap UAF in MediaServer
Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
Memory corruption while processing event close when client process terminates abruptly.
Memory corruption during video playback when video session open fails with time out error.
Memory corruption while processing IOCTL command to handle buffers associated with a session.
Memory corruption during sub-system restart while processing clean-up to free up resources.
memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a LayerStack can be destroyed in between Validate and Commit by the application resulting in a Use After Free condition.
Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.
Memory corruption while processing message in guest VM.
Buffer might get used after it gets freed due to unlocking the mutex before freeing the buffer in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a crafted binder request can cause an arbitrary unmap in MediaServer.
Memory corruption may occur while accessing a variable during extended back to back tests.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in the GLink kernel driver, a Use After Free condition can potentially occur.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a camera driver function, a race condition exists which can lead to a Use After Free condition.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a KGSL driver function, a race condition exists which can lead to a Use After Free condition.
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, if cmd_pkt and reg_pkt are called from different userspace threads, a use after free condition can potentially occur in wdsp_glink_write().
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function mdss_rotator_ioctl in the driver /dev/mdss_rotator, a Use-After-Free condition can potentially occur due to a fence being installed too early.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the VIDIOC_G_SDE_ROTATOR_FENCE ioctl command can be used to cause a Use After Free condition.
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the KGSL driver function kgsl_ioctl_gpu_command, a Use After Free condition can potentially occur.
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in the rmnet USB control driver can potentially lead to a Use After Free condition.
Memory corruption while processing IOCTL calls to add route entry in the HW.
Memory corruption while invoking IOCTL map buffer request from userspace.
Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.
Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations.
Memory corruption during concurrent access to server info object due to unprotected critical field.
Memory corruption while allocating buffers in DSP service.
Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
Memory corruption during concurrent SSR execution due to race condition on the global maps list.
Memory corruption during concurrent buffer access due to modification of the reference count.
Memory corruption while encoding JPEG format.
Memory corruption while handling IOCTL call from user-space to set latency level.
Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
Memory corruption during concurrent access to server info object due to incorrect reference count update.
Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.
Memory corruption while maintaining memory maps of HLOS memory.
Memory corruption while processing command in Glink linux.
Memory corruption while handling file descriptor during listener registration/de-registration.
Memory corruption due to use after free in trusted application environment.
Memory corruption due to use after free in Core when multiple DCI clients register and deregister.
Memory corruption while processing GPU commands.
Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.
Memory corruption while processing IOCTL call for getting group info.
Memory corruption in WLAN due to use after free
Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.
Memory corruption due to use after free in Modem while modem initialization.