Memory corruption in Audio while processing the VOC packet data from ADSP.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Memory corruption in Audio during playback with speaker protection.
Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.
Memory corruption in Audio while processing RT proxy port register driver.
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
Memory corruption while parsing the ADSP response command.
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
Memory Corruption in Audio while invoking callback function in driver from ADSP.
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
Memory corruption while receiving a message in Bus Socket Transport Server.
Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
Memory corruption in HLOS while running playready use-case.
Memory corruption in Audio when SSR event is triggered after music playback is stopped.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
Memory corruption in Audio while running invalid audio recording from ADSP.
Memory corruption when user provides data for FM HCI command control operations.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
Memory corruption in Core Services while executing the command for removing a single event listener.
Memory corruption in TZ Secure OS while loading an app ELF.
Memory corruption while allocating memory in COmxApeDec module in Audio.
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Memory corruption in core services when Diag handler receives a command to configure event listeners.
Memory corruption while processing audio effects.
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
Memory corruption in WLAN HAL while parsing WMI command parameters.
Memory corruption in WLAN HAL while handling command through WMI interfaces.
Memory corruption in SPS Application while requesting for public key in sorter TA.
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a user supplied sparse image, a buffer overflow vulnerability could occur if the sparse header block size is equal to 4294967296.
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in user space. An unchecked userspace value (ioctl_ptr->len) is used to copy contents to a kernel buffer which can lead to kernel buffer overflow.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a graphics driver ioctl handler, the lack of copy_from_user() function calls may result in writes to kernel memory.
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, array access out of bounds may occur in the camera driver in the kernel
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a specially crafted QCA_NL80211_VENDOR_SUBCMD_ENCRYPTION_TEST cfg80211 vendor command a stack-based buffer overflow can occur.
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an integer overflow leading to a buffer overflow due to improper bound checking in msm_audio_effects_virtualizer_handler, file msm-audio-effects-q6-v2.c
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a specially crafted UBI image, it is possible to corrupt memory, or access uninitialized memory.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the fd allocated during the get_metadata was not closed even though the buffer allocated to the fd was freed. This resulted in a failure during exit sequence.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while calculating CRC for GPT header fields with partition entries greater than 16384 buffer overflow occurs.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the HDMI video driver function hdmi_edid_sysfs_rda_res_info(), userspace can perform an arbitrary write into kernel memory.
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
Memory Corruption in HLOS while registering for key provisioning notify.
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.