CVE-2020-11230 | ByteOS Network

Vulnerability Details :

CVE-2020-11230

Assigner-qualcomm

Assigner Org ID-2cfc7d3e-20d3-47ac-8db7-1b7285aff15f

Published At-17 Mar, 2021 | 06:00

Updated At-04 Aug, 2024 | 11:28

Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:qualcomm

Assigner Org ID:2cfc7d3e-20d3-47ac-8db7-1b7285aff15f

Published At:17 Mar, 2021 | 06:00

Updated At:04 Aug, 2024 | 11:28

▼CVE Numbering Authority (CNA)

Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Affected Products

Vendor

Qualcomm Technologies, Inc.

Product

Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Versions

Affected

AQT1000, FSM10055, PM3003A, PM7150A, PM7150L, PM7250, PM7250B, PM7350C, PM8004, PM8008, PM8009, PM8150A, PM8150B, PM8150C, PM8150L, PM8250, PM8350, PM8350B, PM8350BH, PM8350BHS, PM8350C, PM855, PM855A, PM855B, PM855L, PM855P, PMK7350, PMK8002, PMK8350, PMM6155AU, PMM8155AU, PMM8195AU, PMR525, PMR735A, PMR735B, PMX50, PMX55, QAT3514, QAT3516, QAT3518, QAT3519, QAT3555, QAT5515, QAT5516, QAT5522, QAT5533, QAT5568, QBT2000, QCA6390, QCA6391, QCA6420, QCA6421, QCA6426, QCA6430, QCA6431, QCA6436, QCA6574AU, QCA6696, QDM2301, QDM2305, QDM2307, QDM2308, QDM2310, QDM3301, QDM3302, QDM4643, QDM4650, QDM5579, QDM5620, QDM5621, QDM5650, QDM5652, QDM5670, QDM5671, QDM5677, QDM5679, QET4101, QET5100, QET5100M, QET6100, QET6110, QFS2530, QFS2580, QFS2608, QFS2630, QLN4642, QLN4650, QLN5020, QLN5030, QLN5040, QPA2625, QPA5461, QPA5580, QPA5581, QPA6560, QPA8673, QPA8686, QPA8801, QPA8802, QPA8803, QPA8821, QPA8842, QPM4621, QPM4630, QPM4640, QPM4641, QPM4650, QPM5621, QPM5641, QPM5658, QPM5670, QPM5677, QPM5 ...[truncated*]

Problem Types

Type	CWE ID	Description
text	N/A	Time of Check Time of Use Race Condition in HLOS

Type: text

CWE ID: N/A

Description: Time of Check Time of Use Race Condition in HLOS

References

Hyperlink	Resource
https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin	x_refsource_CONFIRM

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin	x_refsource_CONFIRM x_transferred

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

Source:product-security@qualcomm.com

Published At:17 Mar, 2021 | 06:15

Updated At:18 Mar, 2021 | 01:55

Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.4	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	4.4	MEDIUM	AV:L/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 4.4

Base severity: MEDIUM

Vector:

AV:L/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

Qualcomm Technologies, Inc.

>>aqt1000_firmware>>-

cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>fsm10055_firmware>>-

cpe:2.3:o:qualcomm:fsm10055_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:fsm10055:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm3003a_firmware>>-

cpe:2.3:o:qualcomm:pm3003a_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm3003a:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm7150a_firmware>>-

cpe:2.3:o:qualcomm:pm7150a_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm7150a:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm7150l_firmware>>-

cpe:2.3:o:qualcomm:pm7150l_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm7150l:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm7250_firmware>>-

cpe:2.3:o:qualcomm:pm7250_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm7250:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm7250b_firmware>>-

cpe:2.3:o:qualcomm:pm7250b_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm7250b:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm7350c_firmware>>-

cpe:2.3:o:qualcomm:pm7350c_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm7350c:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8004_firmware>>-

cpe:2.3:o:qualcomm:pm8004_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8004:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8008_firmware>>-

cpe:2.3:o:qualcomm:pm8008_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8008:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8009_firmware>>-

cpe:2.3:o:qualcomm:pm8009_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8009:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8150a_firmware>>-

cpe:2.3:o:qualcomm:pm8150a_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8150a:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8150b_firmware>>-

cpe:2.3:o:qualcomm:pm8150b_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8150b:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8150c_firmware>>-

cpe:2.3:o:qualcomm:pm8150c_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8150c:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8150l_firmware>>-

cpe:2.3:o:qualcomm:pm8150l_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8150l:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8250_firmware>>-

cpe:2.3:o:qualcomm:pm8250_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8250:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8350_firmware>>-

cpe:2.3:o:qualcomm:pm8350_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8350:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8350b_firmware>>-

cpe:2.3:o:qualcomm:pm8350b_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8350b:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8350bh_firmware>>-

cpe:2.3:o:qualcomm:pm8350bh_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8350bh:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8350bhs_firmware>>-

cpe:2.3:o:qualcomm:pm8350bhs_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8350bhs:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm8350c_firmware>>-

cpe:2.3:o:qualcomm:pm8350c_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm8350c:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm855_firmware>>-

cpe:2.3:o:qualcomm:pm855_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm855>>-

cpe:2.3:h:qualcomm:pm855:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm855a_firmware>>-

cpe:2.3:o:qualcomm:pm855a_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm855a:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm855b_firmware>>-

cpe:2.3:o:qualcomm:pm855b_firmware:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm855b:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

cpe:2.3:h:qualcomm:pm855l:-:*:*:*:*:*:*:*

Qualcomm Technologies, Inc.

>>pm855l_firmware>>-

cpe:2.3:o:qualcomm:pm855l_firmware:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-367	Primary	nvd@nist.gov

CWE ID: CWE-367

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin	product-security@qualcomm.com	Patch Vendor Advisory

Hyperlink: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin

Source: product-security@qualcomm.com

Resource:

Patch

Vendor Advisory

Similar CVEs

115Records found

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.4||MEDIUM

EPSS-0.04% / 11.10%

||

7 Day CHG~0.00%

Published-17 Mar, 2021 | 06:00

Updated-04 Aug, 2024 | 11:28

While processing storage SCM commands there is a time of check or time of use window where a pointer used could be invalid at a specific time while executing the storage SCM call in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking

Vendor-Qualcomm Technologies, Inc.

Product-wcd9360_firmware pm6125 qat3519 qbt2000_firmware pm855a_firmware wcn3950_firmware qtc800h sdr8250_firmware qcs2290 pm8998_firmware smr546_firmware wtr5975_firmware sdr425_firmware wcn3998 smr526_firmware wcn3950 sm4125 qpa5460 pm640a_firmware qsw8573_firmware wgr7640_firmware qsw8574_firmware sd460_firmware qca6574au_firmware qpa4360_firmware wcd9375_firmware wcn3998_firmware qbt2000 pm855p qca6420 wcd9360 pm6150a pmx50_firmware whs9410_firmware sdr735g qpa5460_firmware wcn3999 sa8155_firmware sd662_firmware qcs405 qca6430 qat3522 wcd9340 sdm830_firmware sdr660 sa6155p qpa6560 sdr865 wcd9341 smr545 qca6696_firmware pmm855au_firmware wcn3910_firmware sd_8cx pm6350 qtc800s sd855_firmware wcn3988 wtr3925 pm640p_firmware sdr052 sa8195p_firmware smb1390 qat5516_firmware pm6150l pm855l_firmware qtc410s wcn3991 smb1355 sdr735g_firmware wgr7640 qet5100 sdx55m_firmware pm8005_firmware qpa8673_firmware pm6150 qet4101_firmware smb1354_firmware pm7250b sdr052_firmware smb1355_firmware pm7250b_firmware pmd9655_firmware smb1351_firmware smb1381 pm855p_firmware sdx50m_firmware sdr735 sdx24_firmware smr526 wtr5975 qca6430_firmware pmk8003 qtc801s_firmware wcn3980 qat3522_firmware qdm2301 qsw8573 wcd9340_firmware wsa8815 wcn6850 wcn3910 qdm2301_firmware sd_8c_firmware pm8350_firmware qca9984 wcn3980_firmware sdr051_firmware sdx55m pm8008 qtm525_firmware qsw8574 pmi8998 pm855l qpa6560_firmware smr545_firmware pm4250_firmware qcm4290_firmware sd480 pmi8998_firmware pm8005 pm855_firmware pm4250 qdm2302 pm855b_firmware qca6595_firmware qcs405_firmware wtr2965 pm640l_firmware wcd9370_firmware sdx55 sa8155p sd675 qet4101 qat3555_firmware pm855b ar8035_firmware qcm2290 wcn3991_firmware sdr051 pm6125_firmware pm4125 qbt1500 qcs2290_firmware pmi632 pmx24_firmware qbt1500_firmware qet5100_firmware qcs4290 sdr660g pmm855au qca6420_firmware qca6390_firmware smb1396 wcd9370 sd675_firmware pm8350 qpa4361_firmware sdr425 wcn3990_firmware qca9984_firmware pmi632_firmware sd_8cx_firmware wcd9385_firmware whs9410 qat5516 sd662 sdr660g_firmware pmk8002_firmware qsw6310_firmware sa8155 sdx55_firmware wcn3999_firmware smb1354 sa6155p_firmware qat5515_firmware pm855 wcn3988_firmware pmx55 sdr735_firmware qat3519_firmware sa8195p wsa8810_firmware qat5515 pm6350_firmware pm8004_firmware sdr8150_firmware qcs4290_firmware wcd9385 qtc800h_firmware qdm2302_firmware qat3550_firmware pm4125_firmware ar8035 qca6390 wcd9375 aqt1000 qpa8673 pmm8195au wtr3925_firmware sd888_5g_firmware smb1396_firmware pm8998 wcn6850_firmware wsa8815_firmware smr546 pmx24 qcm2290_firmware wcn3990 pmx55_firmware qca6595 sdx24 sd665_firmware sd888_5g qpa4360 pm855a pmk8003_firmware sdr660_firmware qca6574a qpa4361 smb1390_firmware pm6150l_firmware qtm525 sd855 sm4125_firmware sd665 pm6150a_firmware pm6150_firmware pm640p qca6574a_firmware sdr865_firmware qat3555 sd460 smb1351 aqt1000_firmware wtr2965_firmware qcm4290 sdx50m pm640a sdr8150 sd480_firmware qtc801s pmd9655 qca6574au sa8155p_firmware qsw6310 pm8008_firmware wcd9341_firmware wsa8810 qtc410s_firmware qat3550 pmx50 sd_8c sdr8250 qca6696 qtc800s_firmware smb1381_firmware pm8004 pm640l pmk8002 pmm8195au_firmware sdm830 Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 8.12%

||

7 Day CHG~0.00%

Published-08 Aug, 2023 | 09:15

Updated-02 Aug, 2024 | 13:43

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel Driver

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues.

Vendor-Qualcomm Technologies, Inc.

Product-fastconnect_7800 snapdragon_865_5g wcd9380_firmware wsa8830 qcs610 sw5100p sd865_5g fastconnect_6900 fastconnect_6800 fastconnect_6900_firmware snapdragon_8_gen_1_firmware wcn3988_firmware qcn9074 snapdragon_870_5g wsa8835 wcn3950_firmware snapdragon_8_gen_1 wsa8810_firmware wcd9380 wcd9341_firmware fastconnect_7800_firmware sw5100 wsa8810 qca6436 qcs410 snapdragon_865\+_5g snapdragon_x55_5g qcs610_firmware sw5100p_firmware sxr2130 wcd9370 snapdragon_865\+_5g_firmware wcn3680b qca6426 sxr2130_firmware wcd9341 wcn3980 qca6391_firmware wcn3950 snapdragon_xr2_5g_firmware wcd9370_firmware wcn3660b wsa8815 snapdragon_870_5g_firmware wsa8830_firmware sd865_5g_firmware qca6426_firmware wcn3660b_firmware wcn3988 wsa8815_firmware snapdragon_x55_5g_firmware wcn3680b_firmware wsa8835_firmware sw5100_firmware qcn9074_firmware fastconnect_6800_firmware qcs410_firmware snapdragon_865_5g_firmware qca6391 wcn3980_firmware qca6436_firmware snapdragon_xr2_5g Snapdragon

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.03% / 10.12%

||

7 Day CHG~0.00%

Published-09 Sep, 2021 | 07:36

Updated-03 Aug, 2024 | 22:32

Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Vendor-Qualcomm Technologies, Inc.

Product-qca9377_firmware wcn3991_firmware wcn3991 wsa8830 wcd9380_firmware sa6150p_firmware sa8145p_firmware sd780g wcn6856_firmware sd888 wsa8835 qca6574 wcd9380 sa8150p_firmware sd888_5g qca6595au_firmware sa6155 wcd9370 qca6574a wcn6855_firmware qca6174a sm7325 wcd9335_firmware qca9377 wcn6750 wcd9385_firmware qca6574_firmware wcn6850 sa8155 qca6574a_firmware qca6574au_firmware qca6595au sa6155_firmware sdx12_firmware wcd9375_firmware wcn6740_firmware sd778g sa6155p_firmware qcs6490 qcm6490_firmware sd480_firmware sa8155_firmware wcn6851_firmware wcn3988_firmware qca6574au sa6145p_firmware sa8155p_firmware sd778g_firmware sa8195p wcd9341_firmware sd480 wcn6855 wcn6851 wcd9335 sa6155p wcn6856 sa6145p qca6174a_firmware wcd9385 wcd9341 qca6696_firmware qcs6490_firmware sa8145p wcn6740 qca6696 wcd9375 sd780g_firmware wcd9370_firmware sa8150p sa6150p sd888_firmware sa8155p wsa8830_firmware qcm6490 sd888_5g_firmware wcn3988 wcn6850_firmware wsa8835_firmware sa8195p_firmware sdx12 wcn6750_firmware sm7325_firmware Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE ID-CWE-476

NULL Pointer Dereference

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.4||MEDIUM

EPSS-0.01% / 1.95%

||

7 Day CHG~0.00%

Published-01 Jun, 2026 | 22:05

Updated-02 Jun, 2026 | 15:28

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

Vendor-Qualcomm Technologies, Inc.

Product-snapdragon_660_mobile_platform_firmware qcn9011_firmware sm4850_firmware qcn9011 wcn3615_firmware molokai qcs8550 monaco_iot_firmware qxm1094 wcn7881 wsa8840_firmware sm8635p_firmware sm6450p_firmware qca8695au_firmware sdr753 lemansau_firmware sd_8_gen1_5g sm7325p_firmware qcm5430 qca6391 sw5100 wcn6450 snapdragon_662_mobile_platform_firmware wcn7760_firmware wcd9370 snapdragon_7_gen_1_mobile_platform_firmware qca6574a qca6698au_firmware snapdragon_g1_gen_2_gaming_platform_firmware sm8750p_firmware video_collaboration_vc1_platform_firmware qxm1094_firmware sa8145p video_collaboration_vc3_platform_firmware snapdragon_auto_4g_modem_firmware qam8397p_firmware qamsrv1h wcd9395_firmware fastconnect_6900 snapdragon_888_5g_mobile_platform_firmware snapdragon_8_gen_3_mobile_platform_firmware qca6688aq snapdragon_695_5g_mobile_platform netrani_firmware snapdragon_690_5g_mobile_platform wcn7860 csrb31024_firmware sm8735p_firmware wcn7861_firmware qca6391_firmware sar1165p_firmware sm7525_firmware sm7550 wsa8832_firmware wsa8845 qca6688aq_firmware wcd9341_firmware sm6450p monaco_iot wcn3660b_firmware sa6155p sxr2250p qca6678aq_firmware qcm5430_firmware snapdragon_690_5g_mobile_platform_firmware sm6475q wcn7860_firmware snapdragon_429_mobile_platform qxm1095 wsa8840 qam8797p wcn6650_firmware qln1083bd snapdragon_870_5g_mobile_platform_firmware wcn3990_firmware sw5100p qca8695au g1_gen_1 sdm429w qcs4290_firmware snapdragon_auto_5g_modem-rf qamsrv1m_firmware snapdragon_865_5g_mobile_platform xrv7209 qcm4325_firmware snapdragon_480_5g_mobile_platform video_collaboration_vc5_platform_firmware sa8255p wcd9370_firmware sm8550p sd865_5g qamsrv1m wcn3980 snapdragon_8_elite_gen_5 iq-615_firmware wcd9378 qpa1083bd snapdragon_7s_gen_3_mobile_platform wcn6755_firmware snapdragon_7\+_gen_2_mobile_platform wcn7881_firmware sar2130p_firmware wcn7880 sm6850_firmware wsa8830 wsa8855c qrb5165m wcd9335_firmware qcs2290_firmware qam8295p_firmware sm6475q_firmware snapdragon_auto_4g_modem sm8750p qmb715_firmware srv1h wcn3620 qmb415_firmware snapdragon_4_gen_1_mobile_platform_firmware snapdragon_6_gen_4_mobile_platform qxm1096_firmware snapdragon_680_4g_mobile_platform wcd9385 snapdragon_x53_5g_modem-rf_system wcn3620_firmware snapdragon_460_mobile_platform sm8845p_firmware snapdragon_8\+_gen_1_mobile_platform snapdragon_7s_gen_3_mobile_platform_firmware snapdragon_460_mobile_platform_firmware qca6574a_firmware sa7255p_firmware qamsrv1h_firmware sm8475p_firmware sm8475p qln1083bd_firmware snapdragon_782g_mobile_platform wcn3910 lemans_au_lgit qcs4490_firmware sm7550_firmware sm7550p_firmware cq8725s_firmware snapdragon_778g_5g_mobile_platform_firmware snapdragon_8_gen_1_mobile_platform_firmware qca6698aq_firmware sa8620p sm6225p sa6150p_firmware snapdragon_8\+_gen_1_mobile_platform_firmware sw5100_firmware fsm100_platform wcn7760 snapdragon_wear_elite_platform_firmware orne iq-8275_firmware snapdragon_6_gen_1_mobile_platform qxm1083_firmware qcs4490 sa6155_firmware lemansau qmp1000 sa4150p sa8155 qcn9012 snapdragon_865\+_5g_mobile_platform g3x_gen_2_firmware snapdragon_778g_5g_mobile_platform snapdragon_8_elite_firmware robotics_rb5_platform sa6150p sdr753_firmware snapdragon_888_5g_mobile_platform sa8195p qca6797aq_firmware snapdragon_480\+_5g_mobile_platform_firmware snapdragon_7\+_gen_2_mobile_platform_firmware vision_intelligence_400_platform_firmware wcn3615 iq-9075_firmware sxr2330p_firmware sa8295p_firmware sa8145p_firmware flight_rb5_5g_platform wcd9371_firmware wcd9326_firmware qca6595au fastconnect_6200_firmware csra6620_firmware snapdragon_685_4g_mobile_platform sm8845p c-v2x_9150 qmp1000_firmware qpa1086bd_firmware 5g_fixed_wireless_access_platform qxm1086_firmware sm8550p_firmware csra6640 qmb715 wcd9390 snapdragon_660_mobile_platform sa8150p fastconnect_7800 sm7325p snapdragon_429_mobile_platform_firmware wcd9371 qcm4490_firmware sa4155p_firmware wsa8850 themisto wsa8835_firmware sm8635p wcd9341 sa8195p_firmware qln1086bd g1_gen_1_firmware snapdragon_695_5g_mobile_platform_firmware kalpeni qca6595 sm6475p_firmware g2_gen_1_firmware wcd9385_firmware qcs6690 robotics_rb2_platform_firmware snapdragon_x53_5g_modem-rf_system_firmware sm7675 wsa8850w_firmware wsa8835 5g_fixed_wireless_access_platform_firmware qca6595au_firmware qam8295p qcm4325 wcn3910_firmware snapdragon_ar1_gen_1_platform sm6475p sm8635_firmware qxm1095_firmware snapdragon_8_gen_3_mobile_platform sd662 wcn6650 sa8255p_firmware milos_firmware sda660_firmware snapdragon_8_elite qcs6690_firmware wcd9380 wcd9375_firmware sa6145p_firmware sa4155p sxr2330p lemans_au_lgit_firmware snapdragon_4_gen_2_mobile_platform_firmware netrani sa6145p qxm1086 xrv9209 fastconnect_6700 pandeiro_firmware milos_iot_firmware qcm6490 wcn3950 sa9000p qcm2290 sm6650p wcn7861 snapdragon_8_elite_gen_5_firmware qualcomm_215_mobile_platform_firmware wcn6755 snapdragon_870_5g_mobile_platform snapdragon_8\+_gen_2_mobile_platform fastconnect_6200 fastconnect_6700_firmware sm7675p snapdragon_6_gen_4_mobile_platform_firmware sa8770p wcn7880_firmware qln1086bd_firmware snapdragon_ar1\+_gen_1_platform_firmware snapdragon_6_gen_3_mobile_platform snapdragon_x55_5g_modem-rf_system_firmware g2_gen_1 sm7635p_firmware video_collaboration_vc1_platform sc8380xp sd662_firmware wcd9390_firmware snapdragon_778g\+_5g_mobile_platform wsa8845_firmware cq8725s qca6574_firmware snapdragon_xr2_5g_platform sm8635 snapdragon_865_5g_mobile_platform_firmware snapdragon_x55_5g_modem-rf_system sd865_5g_firmware snapdragon_480\+_5g_mobile_platform qxm1093_firmware sm6850 g3x_gen_2 wcd9360_firmware snapdragon_778g\+_5g_mobile_platform_firmware srv1m_firmware qca6698aq wcn3990 snapdragon_7_gen_4_mobile_platform wcd9335 xrv7209_firmware sm7635p qcm8838_firmware qmb415 pandeiro snapdragon_888\+_5g_mobile_platform_firmware sa8150p_firmware flight_rb5_5g_platform_firmware qcn9012_firmware wsa8845h_firmware qcm8838 robotics_rb2_platform csra6640_firmware sm6650p_firmware qcm4490 qca6595_firmware qmp2001 palawan25 csra6620 qcs8550_firmware snapdragon_8_gen_2_mobile_platform_firmware sm7435_firmware wsa8850w qcm6490_firmware qca6574 snapdragon_ar1\+_gen_1_platform qca6696_firmware kalpeni_firmware cq7790 sa2150p_firmware qcs2290 qca6696 sw5100p_firmware snapdragon_8_gen_1_mobile_platform wcn3660b wcd9326 wcn3950_firmware srv1h_firmware snapdragon_xr2_5g_platform_firmware sa8620p_firmware wcn6450_firmware qcs4290 srv1m snapdragon_7_gen_1_mobile_platform sxr2250p_firmware snapdragon_7c\+_gen_3_compute iq-615 sa7775p_firmware qcm2290_firmware vision_intelligence_400_platform snapdragon_4_gen_1_mobile_platform sm7435p wcn3980_firmware wcn3988 robotics_rb5_platform_firmware wcn3988_firmware qca6564au_firmware sxr2230p sm6225p_firmware fastconnect_6800_firmware wcd9380_firmware snapdragon_6_gen_3_mobile_platform_firmware qmp2001_firmware sa7255p sm8650q_firmware wcd9360 wcd9378_firmware qrb5165n c-v2x_9150_firmware snapdragon_6_gen_1_mobile_platform_firmware sa6155 sc8380xp_firmware snapdragon_685_4g_mobile_platform_firmware qca6574au_firmware sar2130p sa9000p_firmware sm7675_firmware wcn3680b snapdragon_7_gen_4_mobile_platform_firmware sm4850p qca6564au sd_8_gen1_5g_firmware video_collaboration_vc3_platform sa7775p qca6797aq sm8735p themisto_firmware snapdragon_xr2\+_gen_1_platform snapdragon_865\+_5g_mobile_platform_firmware snapdragon_7c\+_gen_3_compute_firmware qca6678aq iq-9075 snapdragon_4_gen_2_mobile_platform sm7525 wsa8815_firmware qca6698au sxr2230p_firmware snapdragon_g1_gen_2_gaming_platform palawan25_firmware sa6155p_firmware sa8770p_firmware qam8255p_firmware iq-8275 sm7435 wsa8832 wsa8830_firmware snapdragon_888\+_5g_mobile_platform snapdragon_8\+_gen_2_mobile_platform_firmware sa4150p_firmware sar1165p orne_firmware snapdragon_auto_5g_modem-rf_firmware snapdragon_wear_elite_platform xrv9209_firmware sxr2350p sda660 sm4850p_firmware qam8797p_firmware qam8397p wcd9375 snapdragon_680_4g_mobile_platform_firmware qualcomm_215_mobile_platform sdm429w_firmware sm7550p sa8155p_firmware snapdragon_ar1_gen_1_platform_firmware qxm1083 qpa1083bd_firmware cq7790_firmware sxr2350p_firmware snapdragon_662_mobile_platform molokai_firmware snapdragon_782g_mobile_platform_firmware wsa8810_firmware sm7435p_firmware milos_iot qca6574au sa2150p fastconnect_7800_firmware sa8155p video_collaboration_vc5_platform fastconnect_6900_firmware snapdragon_480_5g_mobile_platform_firmware qrb5165n_firmware wsa8810 sa8155_firmware qam8255p qrb5165m_firmware fastconnect_6800 wcd9395 wsa8845h csrb31024 wcn3680b_firmware qpa1086bd sm4850 sm7675p_firmware wsa8815 qxm1096 sa8295p milos wsa8855c_firmware wsa8850_firmware snapdragon_xr2\+_gen_1_platform_firmware snapdragon_8_gen_2_mobile_platform fsm100_platform_firmware sm8650q qxm1093 Snapdragon

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-8.1||HIGH

EPSS-0.16% / 36.70%

||

7 Day CHG~0.00%

Published-12 Dec, 2019 | 08:30

Updated-04 Aug, 2024 | 22:24

Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCN7605, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150

Vendor-Qualcomm Technologies, Inc.

Product-mdm9640_firmware sdm632_firmware msm8996au_firmware sdm845 sdm450_firmware sdm632 sdx24 sdm439 mdm9650 sdm429 msm8940_firmware sm7150_firmware sm6150 msm8909w_firmware msm8996au sm7150 apq8009_firmware msm8917 sdm670 qcs605_firmware mdm9206 sdm670_firmware sdx24_firmware sdm636 sda845_firmware apq8098 qcn7605 mdm9206_firmware qcs605 msm8937_firmware mdm9650_firmware sdm429_firmware sda660 msm8909w apq8009 msm8909_firmware apq8053_firmware sda845 nicobar msm8920 msm8953 sdm450 sdm636_firmware sdm845_firmware apq8098_firmware sdx20 msm8998_firmware sdm660 msm8920_firmware sdm630 mdm9607_firmware qcs405 sdm710 qm215 mdm9607 apq8017_firmware sdm710_firmware qcn7605_firmware msm8937 mdm9207c_firmware mdm9207c sm8150_firmware msm8909 apq8096au sdm439_firmware qcs405_firmware sdm630_firmware sda660_firmware qm215_firmware msm8953_firmware msm8940 sm6150_firmware apq8053 apq8096au_firmware msm8917_firmware msm8998 sm8150 sdx20_firmware apq8017 nicobar_firmware sdm660_firmware mdm9640 Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-416

Use After Free

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-667

Improper Locking

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.01% / 0.88%

||

7 Day CHG-0.01%

Published-06 Jan, 2026 | 22:48

Updated-28 Jan, 2026 | 15:43

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory corruption while processing a config call from userspace.

Vendor-Qualcomm Technologies, Inc.

Product-sm6650p snapdragon_8\+_gen_1_mobile_platform_firmware qca6797aq_firmware snapdragon_4_gen_2_mobile_platform_firmware wsa8832 wcd9390 wcn7860_firmware fastconnect_6900_firmware qmp1000 ssg2115p wcn3950 wcd9385 sxr1230p_firmware wsa8835_firmware wsa8845 sm8550p_firmware wcn7750_firmware wcd9378_firmware wcd9378 sm8735_firmware sm6650 sxr2350p snapdragon_4_gen_2_mobile_platform snapdragon_7_gen_1_mobile_platform_firmware wsa8845h_firmware qcm4490_firmware snapdragon_7_gen_1_mobile_platform sm8635p_firmware snapdragon_ar1_gen_1_platform_\"luna1\"sxr2330p wcd9380_firmware ssg2115p_firmware snapdragon_ar1_gen_1_platform_firmware sm7675p_firmware sg8275_firmware sm7675_firmware wcn6740 snapdragon_ar2_gen_1_platform_firmware wcn6740_firmware wcd9395 wsa8832_firmware snapdragon_8\+_gen_2_mobile_platform qcs4490_firmware wcd9375_firmware sm8750p_firmware wcd9390_firmware fastconnect_6200_firmware snapdragon_8_gen_2_mobile_platform sxr1230p sm7435 fastconnect_7800 sm7675 wsa8810_firmware sm8475p_firmware sxr2250p_firmware sg8275p_firmware wcd9370_firmware wcn7861 sm7675p sm8750p qmp1000_firmware fastconnect_7800_firmware qca6698au_firmware snapdragon_ar1_gen_1_platform_\"luna1\"_firmware sm6650_firmware sxr2230p wcn7860 snapdragon_6_gen_1_mobile_platform wcd9380 sm7635 ssg2125p_firmware snapdragon_8_gen_3_mobile_platform wcd9395_firmware sm8550p snapdragon_8\+_gen_1_mobile_platform fastconnect_6200 sm7550p_firmware wcn7880 snapdragon_8_gen_2_mobile_platform_firmware sg8275p wcd9370 wsa8830_firmware wcn3988 sm7550p sm7635_firmware wcn7750 wsa8815_firmware wsa8830 qcs8550_firmware sxr2330p_firmware wcd9371_firmware sm8475p snapdragon_ar1_gen_1_platform wsa8845h qca6698au wcn6650_firmware ssg2125p sm7550 snapdragon_7\+_gen_2_mobile_platform sm7635p_firmware wcn7881 qcm4490 wcd9385_firmware wcn6650 wcn7881_firmware qcs4490 wcn6755_firmware wcn6755 qcm8550 fastconnect_6700 wsa8815 qca6797aq fastconnect_6700_firmware sm8635_firmware sg8275 snapdragon_8_gen_3_mobile_platform_firmware sm8635p wcn7861_firmware snapdragon_6_gen_1_mobile_platform_firmware sm7550_firmware qcm8550_firmware sm6650p_firmware sxr2230p_firmware snapdragon_8\+_gen_2_mobile_platform_firmware sxr2350p_firmware wsa8835 qcs8550 sxr2250p wcd9375 sm8635 sm7635p wcn3950_firmware wsa8840 wsa8840_firmware snapdragon_7\+_gen_2_mobile_platform_firmware sm8750_firmware wsa8845_firmware fastconnect_6900 sm7435_firmware sm8750 wcn7880_firmware wcn3988_firmware sm8650q snapdragon_ar2_gen_1_platform sm8735 wsa8810 wcd9371 sm8650q_firmware Snapdragon

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.01% / 0.88%

||

7 Day CHG-0.01%

Published-06 Jan, 2026 | 22:48

Updated-27 Jan, 2026 | 21:24

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory corruption while handling sensor utility operations.

Vendor-Qualcomm Technologies, Inc.

Product-snapdragon_695_5g_mobile_platform_firmware sm8735_firmware wcd9375_firmware qcm5430 wcn3988_firmware sm8650q_firmware qca6595au_firmware snapdragon_8_gen_3_mobile_platform wcd9375 qca6574 wcn7860_firmware snapdragon_4_gen_2_mobile_platform_firmware wcn7861 qcs4490_firmware qca6574au_firmware sm7635p sm8635p_firmware sm6650_firmware wcn7880 qcs4490 sa6155p_firmware wsa8845_firmware video_collaboration_vc3_platform_firmware snapdragon_ar1_gen_1_platform_\"luna1\"_firmware sm8635p snapdragon_8_gen_3_mobile_platform_firmware sxr2250p_firmware wcn7750 sm8635_firmware qcs8550_firmware snapdragon_680_4g_mobile_platform qca6574a wcd9395_firmware wcn7881_firmware sm8750 sm4635_firmware sa8195p_firmware wsa8810_firmware snapdragon_480_5g_mobile_platform qca6595au qca6696_firmware robotics_rb2_platform_firmware sa8155p_firmware sm6650p sm8750p_firmware snapdragon_ar1_gen_1_platform_firmware wcn7860 qcs5430 sxr2330p qcs9100 qca6698aq_firmware wsa8835_firmware snapdragon_685_4g_mobile_platform_\(sm6225-ad\)snapdragon_480\+_5g_mobile_platform_\(sm4350-ac\)qcm5430_firmware wcn7881 qcs9100_firmware sm6650p_firmware sxr2330p_firmware fastconnect_6200_firmware csra6640 wcd9335 qca6574_firmware wsa8810 qca6574au qcm4490 wcn6755_firmware qca6574a_firmware csra6620 wsa8845h qcm4490_firmware sm7635_firmware wcn3950_firmware wcn7750_firmware wcn3950 sm6650 sm7635p_firmware sxr2250p fastconnect_6700_firmware fastconnect_6900_firmware sxr2230p_firmware wcn6740_firmware wcn6650 qcm6490_firmware fastconnect_6200 sm8735 sxr2350p robotics_rb2_platform wcn6650_firmware sm7635 sm8635 snapdragon_680_4g_mobile_platform_firmware snapdragon_695_5g_mobile_platform qcs8550 snapdragon_4_gen_2_mobile_platform fastconnect_6900 sa8155p sm8750p wcn6740 wsa8832 sm7675_firmware wcd9370 wcn6755 wcd9390 fastconnect_7800 snapdragon_480_5g_mobile_platform_firmware wsa8832_firmware qca6698aq wsa8840 sm8750_firmware sa6155p snapdragon_4_gen_1_mobile_platform wsa8830 sm7675p qmp1000 wcd9385 snapdragon_685_4g_mobile_platform_\(sm6225-ad\)_firmware qcs5430_firmware snapdragon_ar2_gen_1_platform_firmware snapdragon_ar2_gen_1_platform fastconnect_7800_firmware qcs6490 snapdragon_ar1_gen_1_platform snapdragon_662_mobile_platform wcd9335_firmware wsa8830_firmware qmp1000_firmware snapdragon_4_gen_1_mobile_platform_firmware wsa8840_firmware wsa8815_firmware wsa8835 wcn7880_firmware wcd9385_firmware sxr2230p qca6696 wcd9380_firmware csra6620_firmware wcn3988 video_collaboration_vc3_platform sm7675 qcm6490 sm7675p_firmware qcs6490_firmware wsa8815 wcd9378_firmware qcs615_firmware wcd9370_firmware sa8195p wsa8845 wsa8845h_firmware snapdragon_ar1_gen_1_platform_\"luna1\"qcs615 sm4635 wcd9378 wcd9395 sxr2350p_firmware wcd9380 snapdragon_662_mobile_platform_firmware snapdragon_480\+_5g_mobile_platform_\(sm4350-ac\)_firmware fastconnect_6700 wcd9390_firmware wcn7861_firmware sm8650q csra6640_firmware Snapdragon

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-10

Assigner-Qualcomm, Inc.

Matching Score-10

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.03% / 10.12%

||

7 Day CHG~0.00%

Published-21 Nov, 2019 | 14:38

Updated-04 Aug, 2024 | 22:24

Race condition due to the lack of resource lock which will be concurrently modified in the memcpy statement leads to out of bound access in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8939, MSM8953, MSM8996AU, MSM8998, Nicobar, QCN7605, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150

Vendor-Qualcomm Technologies, Inc.

Product-mdm9640_firmware sdm632_firmware msm8996au_firmware sdm845 sdm632 sdx24 sdm439 mdm9650 sdm429 sm7150_firmware sm6150 msm8909w_firmware msm8996au sm7150 apq8009_firmware qcs605_firmware mdm9206 sdx24_firmware sdm636 sda845_firmware apq8098 qcn7605 mdm9206_firmware msm8939 qcs605 mdm9640 sdm429_firmware mdm9650_firmware msm8905_firmware sda660 msm8909w apq8009 apq8053_firmware sda845 nicobar msm8953 sdm636_firmware apq8098_firmware sdx20 msm8998_firmware sdm660 sdm630 mdm9607_firmware qcs405 sdm710 qm215 mdm9607 apq8017_firmware sdm710_firmware msm8939_firmware qcn7605_firmware mdm9207c_firmware msm8905 mdm9207c sm8150_firmware apq8096au sdm439_firmware qcs405_firmware sdm630_firmware sda660_firmware qm215_firmware msm8953_firmware apq8053 apq8096au_firmware sm6150_firmware msm8998 sm8150 sdx20_firmware apq8017 nicobar_firmware sdm660_firmware sdm845_firmware Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 9.46%

||

7 Day CHG~0.00%

Published-21 Jan, 2021 | 09:41

Updated-04 Aug, 2024 | 11:28

Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Vendor-Qualcomm Technologies, Inc.

Product-qfs2580 wsa8830 qln5030 qbt1500 pmi632 qpa5581 qdm2307 qfs2530 qpa8802 pm6125 qat3519 qcs4290 qet6100 pmm855au sdr660g pm8150a qtc800h qdm5670 qpa8686 pm7150l qpa8821 pm7150a smb1396 wcd9370 qdm5671 sdr425 qca6426 qat3518 wcn3998 wcn3950 qat5516 wcn3660b qdm5620 sd662 pm3003a sa8155 qdm5652 sd6905g qat5533 qca6595au qpm5679 qbt2000 qpm8870 pm6150a smb1354 qca6584au qdm2305 qpm8820 pm8150b qsm7250 pm8250 pmx55 qat3522 pmr735a qca6421 qdm3301 sa8195p qpm5677 qat5515 sd765g qca6436 sdr660 wcn6851 sa6155p qpa6560 sdr865 wcd9385 wcd9341 qca6431 qln5020 sd750g qca6390 wcd9375 qpa8673 sa8150p pm6350 pmm8195au qdm2310 qdm5621 qln4642 sda429w qdm5650 wcn3988 wtr3925 wcn3620 smb1390 pm6150l wcn3610 qet6110 qln5040 qpm8895 qpm6585 qtc410s qpm5670 wcn3991 smb1355 qln4650 qpa8801 wgr7640 qet5100 qca6595 qpm8830 sdxr25g pm6150 qat5522 wsa8835 pm7250b pm8150c pmr735b qpa8842 wcd9380 qpa4360 qca6574a sdr735 pm7250 smb1395 smr525 qpa8803 smr526 wcn3980 pmk8003 wcn6750 pmr525 qdm2301 qpm4650 qtm525 wsa8815 wcn6850 sd665 sd765 pm640p qat3555 pm8009 sd460 qca6391 sdx55m pm8008 qsw8574 qcm4290 pm640a qtc801s sd8655g qca6574au qpm5621 qpm6582 wsa8810 pm8150l qdm2308 qat3550 qdm5677 qdm5679 sdr8250 sd768g wtr2965 qca6696 qpa2625 pm640l pmk8002 sdx55 sd675 qet4101 qat3516 sm7250p qpm5658 qpa5580 Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.03% / 10.12%

||

7 Day CHG~0.00%

Published-02 Nov, 2020 | 06:21

Updated-04 Aug, 2024 | 11:28

u'Two threads running simultaneously from user space can lead to race condition in fastRPC driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8053, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9607, MSM8953, Nicobar, QCA6390, QCS404, QCS405, QCS610, Rennell, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDA845, SDM429, SDM429W, SDM632, SDM660, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130

Vendor-Qualcomm Technologies, Inc.

Product-ipq5018_firmware kamorta_firmware qcs610 sdm429w sdm632_firmware sdm632 qcs404_firmware sdm429 sm7150_firmware sm6150 agatti_firmware sdm429w_firmware sm7150 qca6390_firmware sxr2130 sc8180x ipq4019_firmware qcs404 ipq8074 sda845_firmware ipq5018 bitra ipq6018_firmware sa515m bitra_firmware sdm429_firmware ipq8064 sdx55_firmware apq8053_firmware agatti ipq8064_firmware sda845 nicobar sa6155p_firmware msm8953 sa515m_firmware sdm660 mdm9607_firmware sm8250_firmware sc8180x_firmware qcs405 ipq8074_firmware sa8155p_firmware mdm9607 sa6155p qcs610_firmware ipq6018 sm8150_firmware sxr2130_firmware qcs405_firmware rennell rennell_firmware qca6390 ipq4019 sdx55 msm8953_firmware apq8053 sa8155p saipan_firmware sm6150_firmware sm8250 sm8150 kamorta nicobar_firmware saipan sdm660_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 8.41%

||

7 Day CHG~0.00%

Published-21 Jan, 2021 | 09:41

Updated-04 Aug, 2024 | 11:28

Race condition in HAL layer while processing callback objects received from HIDL due to lack of synchronization between accessing objects in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Vendor-Qualcomm Technologies, Inc.

Product-qfe3100 qfe2550 qfe4465fc sdr051 pm660 qbt1500 qca8337 pmi632 csra6620 qtc800h msm8917 apq8076 qca9377 wcn3998 whs9410 wcn3950 qpa5460 wtr2955 wcn3660b qfe4320 smb1380 qfe4308 apq8037 wcn3615 qbt2000 msm8909w pm855p qca6420 wcd9360 qtc800t pm8940 wcd9306 qca6584au qca6310 pm8937 qfe2081fc wcn3999 pm855 sdm630 msm8976sg qcc1110 qca6430 qcs405 qat3522 qfe2101 qfe4455fc smb1360 wcd9340 pm8953 smb231 qfe3440fc qat3514 sdr660 wcd9326 wcd9335 msm8937 apq8052 smb1358 wcd9341 pm439 pmi8952 aqt1000 msm8956 msm8976 qtc800s msm8952 apq8056 sd660 sd712 wtr3925 pmi8937 pm8998 qfe2080fc sdr052 sdw3100 smb1390 wcn3620 msm8916 apq8017 qca6564a pmx24 sd450 qet4100 wcn3610 wcn3990 smb1355 wcd9330 wgr7640 sd636 qet5100 qca6564au sdx24 msm8996au pmm8996au rgr7640au qln1035bd qpa4360 pm855a smb1381 qca6574a qca6174a pm660l wtr4905 wtr5975 wcn3980 qsw8573 qcs605 sd855 wsa8815 sd8cx qbt1000 qfe4305 qca6320 qfe4309 sd835 smb1351 pm670a qfe4373fc qfe2082fc msm8920 msm8953 pmi8998 pm660a qpa4340 sdx50m sdr8150 pm855l pm8916 qcs603 qtc801s rsw8577 pmd9655 qfe4302 qca6574au sd710 apq8009w qfe4303 wsa8810 pm670 qat3550 pmx50 pm8005 wcn3680b apq8096au ar8031 wtr2965 qfe4301 pm8004 qet5100m msm8940 apq8053 sdw2500 csra6640 sd439 qet4101 pm8952 pm670l sdm830 pm855b pm8956 Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.05% / 15.74%

||

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-16 Sep, 2024 | 23:11

Due to a race condition while processing the power stats debug file to read status, a double free condition can occur in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.

Vendor-Qualcomm Technologies, Inc.Google LLC

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-415

Double Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.04% / 11.77%

||

7 Day CHG~0.00%

Published-30 Sep, 2019 | 15:40

Updated-04 Aug, 2024 | 18:42

Possible use-after-free issue due to a race condition while calling camera ioctl concurrently in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, QCS405, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM439, SDX24

Vendor-Qualcomm Technologies, Inc.

Product-sd_712 sd_850 sd_632 sd_855 sd_730_firmware qualcomm_215 sd_675 sd_439 sd_670_firmware sd_429 sd_425 sdx24 sdm439 sd_710_firmware qcs405 sd_625 msm8909w_firmware sd_450_firmware sd_845_firmware sd_439_firmware qualcomm_215_firmware sd_429_firmware qcs605_firmware sd_675_firmware sd_425_firmware sd_730 sd_665 sd_850_firmware sdx24_firmware sd_625_firmware sd_450 sdm439_firmware qcs405_firmware sd_712_firmware sd_845 qcs605 sd_670 sd_632_firmware sd_710 msm8909w sd_665_firmware sd_855_firmware Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.04% / 11.77%

||

7 Day CHG~0.00%

Published-25 Jul, 2019 | 16:33

Updated-04 Aug, 2024 | 18:49

Possible race condition that will cause a use-after-free when writing to two sysfs entries at nearly the same time in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, QCS405, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM439, SDM660, SDX20, SDX24

Vendor-Qualcomm Technologies, Inc.

Product-sd_712 sd_850 sd_632 sd_855 sd_730_firmware qualcomm_215 sd_675 sd_439 sdx20 sd_670_firmware sd_429 sd_425 sdm660 sdm439 sd_710_firmware sdx24 sd_636 qcs405 sd_625 msm8909w_firmware sd_636_firmware sd_450_firmware sd_845_firmware sd_439_firmware qualcomm_215_firmware sd_429_firmware qcs605_firmware sd_675_firmware sd_425_firmware sd_730 sd_665 sd_850_firmware sdx24_firmware sd_625_firmware sd_450 sdm439_firmware qcs405_firmware sd_712_firmware sd_845 qcs605 sd_670 sd_632_firmware sd_710 sdx20_firmware msm8909w sd_665_firmware sdm660_firmware sd_855_firmware Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.01% / 2.06%

||

7 Day CHG~0.00%

Published-10 Jan, 2018 | 22:00

Updated-16 Sep, 2024 | 16:13

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the SPCom kernel driver, a race condition exists when creating a channel.

Vendor-Qualcomm Technologies, Inc.Google LLC

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.01% / 2.06%

||

7 Day CHG~0.00%

Published-30 Mar, 2018 | 21:00

Updated-16 Sep, 2024 | 22:25

Due to a race condition in MDSS rotator in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-20, a double free vulnerability may potentially exist when two threads free the same perf structures.

Vendor-Qualcomm Technologies, Inc.Google LLC

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-415

Double Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.03% / 10.30%

||

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-17 Sep, 2024 | 01:41

Due to a race condition in a bus driver, a double free in msm_bus_floor_vote_context() can potentially occur in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

Vendor-Qualcomm Technologies, Inc.Google LLC

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-415

Double Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.01% / 2.06%

||

7 Day CHG~0.00%

Published-16 Nov, 2017 | 22:00

Updated-13 May, 2026 | 00:24

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in the function audio_effects_shared_ioctl(), memory corruption can occur.

Vendor-Google LLC Qualcomm Technologies, Inc.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.01% / 3.11%

||

7 Day CHG~0.00%

Published-05 Dec, 2017 | 17:00

Updated-13 May, 2026 | 00:24

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a camera driver function, a race condition exists which can lead to a Use After Free condition.

Vendor-Google LLC Qualcomm Technologies, Inc.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.01% / 2.41%

||

7 Day CHG~0.00%

Published-05 Dec, 2017 | 17:00

Updated-13 May, 2026 | 00:24

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a video driver, a race condition exists which can potentially lead to a buffer overflow.

Vendor-Google LLC Qualcomm Technologies, Inc.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.01% / 3.11%

||

7 Day CHG~0.00%

Published-05 Dec, 2017 | 17:00

Updated-13 May, 2026 | 00:24

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a KGSL driver function, a race condition exists which can lead to a Use After Free condition.

Vendor-Google LLC Qualcomm Technologies, Inc.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.03% / 10.30%

||

7 Day CHG~0.00%

Published-06 Jul, 2018 | 17:00

Updated-16 Sep, 2024 | 23:42

Due to a race condition in a camera driver ioctl handler in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, a Use After Free condition can occur.

Vendor-Qualcomm Technologies, Inc.Google LLC

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.03% / 10.46%

||

7 Day CHG~0.00%

Published-09 Jun, 2021 | 05:00

Updated-04 Aug, 2024 | 11:28

A race between command submission and destroying the context can cause an invalid context being added to the list leads to use after free issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Vendor-Qualcomm Technologies, Inc.

Product-qfs2580 qca9377_firmware qpm5679_firmware sm6250p_firmware pmd9607_firmware qca8337 qdm5579 qfs2608_firmware qfs2530 qpm8870_firmware qln1030 pm6125 qat5522_firmware wcn3950_firmware pm8150a qdm5670 qca6595au_firmware qpm5541_firmware qpa5581_firmware sa6155 pm7150l qcc1110_firmware pm8998_firmware qpa8821 sd_455_firmware wtr5975_firmware qcs6125_firmware pm456_firmware qpa5580_firmware sa415m wcn3998 wcd9371_firmware wcn3950 sm4125 sd720g mdm9206_firmware qsw8573_firmware wcn3660b sd450_firmware qfe4320 qsw8574_firmware sd460_firmware smb2351_firmware pm8953_firmware qpa4360_firmware wcn3998_firmware qfe2520_firmware apq8009w_firmware pm855p apq8053_firmware qca6420 pm6150a qpm6670_firmware qca9367_firmware pm660_firmware pm8150b sa8155_firmware qfe2101 qca6430 qat3522 pmr735a wcd9340 sdm830_firmware sd765g sdr660 qfs2630_firmware sdr865 qdm5620_firmware smb1358 qca6696_firmware qln5020 wcd9371 smb1350 pmm855au_firmware sm4350_firmware sd_8cx pm6350 qdm5621 qfe3340 qtc800s qat3514_firmware sd660 sd865_5g_firmware pm640p_firmware sd660_firmware wcn6750_firmware qat5516_firmware pm6150l sd450 pm855l_firmware qtc410s wcn3991 qpa8801 sdm429w pm8150l_firmware qat5533_firmware sdx55m_firmware qpa8673_firmware pm6150 smb1354_firmware sd670_firmware qca6574 sd632_firmware qfs2630 qpa8842 sdr052_firmware pmm8996au wcd9380 qualcomm215 qln4640 qcs410 qpm5579_firmware smb1380_firmware qfe4309_firmware pmk8350_firmware smb1381 pm855p_firmware sd690_5g_firmware pm7250 qca9379_firmware wtr4905 qpa8803 sdx24_firmware sd439_firmware qdm2301 wcd9340_firmware wsa8815 wcn6850 qfe2101_firmware qdm5621_firmware qdm2301_firmware qpm6375 sd_8c_firmware sd835 wcn3980_firmware sd730 pm660l_firmware pm6250_firmware wcn6740_firmware pm8008 pm8350b_firmware qtm525_firmware pme605_firmware pme605 apq8064au_firmware qpm5621_firmware qln1021aq_firmware qcs603 rsw8577 qpa6560_firmware qpa8802_firmware qln4640_firmware qfe4308_firmware qpm5621 qpm6582 sd670 pm8009_firmware apq8009w qfe4303 qfs2580_firmware qcm4290_firmware pm8150l pmi8998_firmware qcs610_firmware sa6145p pm660a_firmware pm215 ar8031 qpm5577 wtr2965 sdm630_firmware qca6391_firmware pmx20_firmware pm8150 pmi8937_firmware wcd9370_firmware qat3516_firmware sdx55 apq8053 csra6640 pm8350bhs qat3555_firmware qpa8803_firmware wcn3660 qca9379 pm855b smb2351 qln1031 qsm8250_firmware qpm5870 pm8909 wsa8830 pm660 qet6110_firmware qdm5579_firmware qpm6325 pm6125_firmware qbt1500 qpa5581 csrb31024 mdm9650 sd_636 pmx24_firmware fsm10055_firmware qbt1500_firmware qpm5870_firmware qcs4290 qet6100 pmm855au qca6420_firmware smb1394_firmware apq8009_firmware sd690_5g smb1396 pm7150a sd675_firmware pm8350 qca6564 qpa4361_firmware pm8350c_firmware qpa5461_firmware qca6426 wcn3990_firmware qca9377 qpm5641 qpa5373_firmware wcd9385_firmware qdm5650_firmware qpa4340_firmware sdxr2_5g_firmware wcd9326_firmware wcn3615_firmware wtr2955 rgr7640au_firmware pm7250_firmware sdr845_firmware qdm5620 qln1021aq smb1380 pmk8002_firmware qsw6310_firmware sa8155 qln1031_firmware qdm4650_firmware sdx55_firmware pmm6155au_firmware qat5533 wcn3615 sm7250p_firmware wcn3610_firmware qsm7250_firmware qpm6670 pm7150l_firmware qca6584au qpm4641 qat5515_firmware pm855 qpm8830_firmware sd429 pm8250 qca9367 sdm630 qdm4643 qfs2530_firmware sa415m_firmware pmx55 qpm4641_firmware wcn3988_firmware sd205 sd429_firmware pm8150c_firmware qca6421 qdm3301 qpa8842_firmware qat3519_firmware sdr735_firmware pm8953 qat5515 qpm5677 qat3514 wcd9326 wcd9335 pm6350_firmware pm8004_firmware sdr8150_firmware qcs4290_firmware pm439 qtc800h_firmware pmk7350_firmware qpm5620 qpm4630 qca6390 wcd9375 sd750g_firmware aqt1000 sm6250_firmware qln4642 msm8917_firmware qpm5677_firmware sdx20_firmware wsa8815_firmware sd888_5g_firmware pmi8937 pm8998 pmk7350 sdw3100 qpm8820_firmware smr525_firmware wtr3925_firmware qfe4301_firmware apq8017 qln1020_firmware qpm6621_firmware pm670a_firmware qcm6125_firmware pmx55_firmware wtr2955_firmware qbt1000_firmware qfe4373fc_firmware sd865_5g pm8150_firmware smb1398_firmware qpm8830 pmm8996au_firmware qat5522 pm8150c pmr735b sd665_firmware qpa4360 pmk8003_firmware qpa4361 qpm4640_firmware mdm9206 qpm5577_firmware qdm5679_firmware pm8350c smr525 qca6310_firmware qfe4305_firmware pm6150l_firmware pmr525 pm8150a_firmware qca6574_firmware qln1036aq_firmware sd665 pm6150a_firmware pm6150_firmware sd765 pmx20 pmd9607 qca6574a_firmware qpm4630_firmware qat3555 apq8009 qpa5461 wtr2965_firmware pm670_firmware csrb31024_firmware qfs2608 qln1036aq qtc801s qpm5641_firmware sd710 pm8008_firmware sdx20m_firmware qpm6621 pmr735a_firmware pmw3100 pmx50 qca6564_firmware sdr8250 sd768g qln1030_firmware smb1350_firmware wcn6740 pmw3100_firmware pm8004 pm640l pmk8002 apq8096au_firmware sd845 sdm830 smb1357 qcs410_firmware qpa5580 qpm5579 fsm10055 qfe2550 qcs610 qpm5620_firmware qdm2307 qca6431_firmware qpa8802 qpm6585_firmware qat3519 qbt2000_firmware pm855a_firmware qtc800h sdr8250_firmware qcs2290 qca6335 msm8917 csra6620_firmware qcs605_firmware qln1020 sd_675_firmware qdm5671 csra6640_firmware pmc1000h qpm4650_firmware qat3518 sd632 sdr425_firmware smr526_firmware qpa5460 pm640a_firmware wgr7640_firmware qdm2305_firmware qpm5670_firmware sd710_firmware qca4020 qdm5652 qca6574au_firmware qpm8870 wcd9375_firmware qpm5679 qbt2000 sa6155_firmware msm8909w sdx20m pmx50_firmware qpa8675_firmware sdr735g qpa5460_firmware wcn3999 qdm3301_firmware qsm7250 qcs6125 sd662_firmware qcc1110 qcs405 smb1360 qualcomm215_firmware rsw8577_firmware qdm2308_firmware fsm10056_firmware pm439_firmware qca4020_firmware qca6436 sa6155p wcn6851 qcs603_firmware qpa6560 sdr675_firmware wcn3660_firmware wcd9341 pmi8952 qdm4643_firmware pm8937_firmware qca6431 sm7350_firmware qet4100_firmware sd750g qfe4320_firmware qdm3302 wcn3910_firmware qpm5657 qpm5875_firmware wsa8830_firmware sd855_firmware qdm5650 wcn3988 wtr3925 sdr052 smb1390 sdw3100_firmware qet4100 wcn3610 qpa8686_firmware qpm6585 qca8337_firmware sda429w_firmware wcd9380_firmware smb1355 qln4650 qtc800t_firmware wcd9330 msm8996au_firmware sdr735g_firmware pm8350bhs_firmware wgr7640 qat5568 qet5100 qdm5671_firmware qpa8801_firmware qca6564au qtm527_firmware wcn6856_firmware pm8005_firmware qet4101_firmware pm7250b qln4642_firmware smb1355_firmware pm7250b_firmware pmd9655_firmware smb1351_firmware sdx50m_firmware sdr735 smb1395 pm660l ar8151 smr526 wtr5975 qca6430_firmware pmk8003 qtc801s_firmware wcd9335_firmware qat3522_firmware wcn3980 pm7350c_firmware qca6335_firmware qsw8573 qcs605 qbt1000 wcn3910 qca6320 mdm9650_firmware smb1394 qca6426_firmware pm8350_firmware wcn3660b_firmware wcn3680 qfe4309 pm8009 qpa8675 sdr051_firmware wcd9330_firmware sdx55m pm670a qca6421_firmware qfe4373fc msm8953 qat3518_firmware pmi8998 qfe2520 qsw8574 ar8031_firmware wcn3680_firmware pm855l wcn6851_firmware qdm5670_firmware pm7150a_firmware pm8150b_firmware qfe4302 sd_636_firmware pmc1000h_firmware qca6564a_firmware qdm2310_firmware pm670 sd210_firmware qdm5677 pm8005 qsm8250 pm855_firmware qdm2302 pmm6155au sdxr1 pm855b_firmware apq8096au qcs405_firmware qpm6582_firmware qpm6375_firmware pm640l_firmware qln4650_firmware qpm5875 qet5100m sa8155p sd675 sd439 qet4101 qat3516 pm670l qpm5658 ar8035_firmware qcm2290 qpm5658_firmware wcn3991_firmware qdm5652_firmware pmm8155au_firmware sdr051 qln5030 qcs2290_firmware pm4125 fsm10056 pmi632 qpa2625_firmware pm456 pm8350bh_firmware csra6620 pmr735b_firmware qet5100_firmware qpa5373 qpm4621 smb1360_firmware qet6100_firmware pm670l_firmware sdr660g sd765g_firmware qpa8686 smb1358_firmware qca6390_firmware sd730_firmware wcd9370 sdr425 pmr525_firmware qca6584au_firmware qfe3340_firmware ar8151_firmware pmi632_firmware sd_8cx_firmware qpm5541 qat5516 sd662 qpa8821_firmware qfe4308 sdr660g_firmware pm8350bh pm3003a qca6320_firmware wcn3680b_firmware qca6595au wcn3999_firmware qca6436_firmware qtc800t sm7350 smb1354 qca6564au_firmware qdm2305 sa6155p_firmware qca6310 qpm8820 pm8937 qpm2630 qln5020_firmware sa515m_firmware sdxr2_5g smb1398 sa6145p_firmware sdr675 sm6250 apq8017_firmware wsa8810_firmware smb231 sd765_firmware qdm5677_firmware qca6174a_firmware wcd9385 qpm6325_firmware qdm2302_firmware qat3550_firmware pmm8155au qln5040_firmware pm4125_firmware ar8035 apq8064au qpa8673 qdm2310 qfe2550_firmware msm8953_firmware qln5030_firmware sda429w sd210 wcn3620_firmware qfe4302_firmware smb1396_firmware wcn6850_firmware wcn3620 wsa8835_firmware qca6564a pmx24 qet6110 pmi8952_firmware qcm2290_firmware qln5040 qpm8895 sdr845 qpm5670 wcn3990 sd_675 qtm527 pmk8350 sdx24 qdm3302_firmware pm8350b qdm2307_firmware msm8909w_firmware wsa8835 msm8996au sdm429w_firmware qpm5657_firmware sd888_5g sm6250p rgr7640au pm855a sdr660_firmware pm8909_firmware qca6574a pm8916_firmware smb1390_firmware qca6174a qfe4303_firmware qpm4640 wcn6750 pm7350c qet5100m_firmware qpm4650 qtm525 sa515m wtr6955 sd855 sm4125_firmware qfe4305 wtr6955_firmware pm640p sd768g_firmware sdr865_firmware pm8250_firmware sd460 qca6391 sdxr1_firmware smb1351 smb1357_firmware aqt1000_firmware pm215_firmware qpm8895_firmware pm660a qpa4340 qcm4290 sdx50m pm640a sdr8150 sdx20 pm8916 smb1395_firmware qdm4650 sd_455 pmd9655 qca6574au sa8155p_firmware sd205_firmware qsw6310 wcd9341_firmware qcm6125 wsa8810 qtc410s_firmware qpm2630_firmware smb231_firmware qat5568_firmware qdm2308 qat3550 wtr4905_firmware wcn6856 qdm5679 sd_8c wcn3680b sd835_firmware pm3003a_firmware qca6696 qfe4301 qtc800s_firmware sm4350 sd845_firmware smb1381_firmware qpa2625 sm7250p sd720g_firmware qpm4621_firmware pm6250 Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.04% / 11.46%

||

7 Day CHG~0.00%

Published-13 Jan, 2022 | 11:40

Updated-03 Aug, 2024 | 22:32

Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Vendor-Qualcomm Technologies, Inc.

Product-qca9377_firmware sa6150p_firmware qcs610 ipq4028_firmware qcn5550 qca8337 ar9380 ipq8173_firmware sdx65 qcn5124 qca4024_firmware wcn3950_firmware ipq8078a ipq5028_firmware sa8150p_firmware qcs2290 qca6595au_firmware sa6155 qcn5064 csra6620_firmware qcs605_firmware csra6640_firmware qca9987_firmware wcn3998 wcn3950 qcn6024_firmware ipq8076a sd_8_gen1_5g_firmware sm6375_firmware wcn3660b sd460_firmware sm7315_firmware qca6428 qca6574au_firmware qcn5164_firmware ipq8071 wcd9375_firmware qca8081_firmware wcn3998_firmware sa6155_firmware sdx12_firmware qca6438_firmware qca9986 ipq8070_firmware ipq8065 ipq8078a_firmware wcn3999 qrb5165_firmware ipq5028 qca7500 ipq8072_firmware ipq4029_firmware sa8155_firmware ipq6010 sd662_firmware ipq8068 qcs405 wcd9340 sd765g qualcomm215_firmware qca6436 wcn6851 sa6155p qcs603_firmware qca9888_firmware qcn6122 wcd9341 ipq8068_firmware qca6696_firmware sd870_firmware qca9988_firmware qcn5154_firmware wcn3910_firmware sa8150p wsa8830_firmware qca9992_firmware sd865_5g_firmware wcn3988 qca6438 sa8195p_firmware sm8475 qcn5022_firmware wcn6750_firmware qca9898 ipq4028 wcn3610 qca6428_firmware ipq5018_firmware sm6375 qca9985_firmware wcn3991 ipq4018_firmware qca8337_firmware sda429w_firmware wcd9380_firmware ipq8072a qca7500_firmware qca9980_firmware ipq8076a_firmware ipq8078 qca6564au sdx55m_firmware ipq8173 wcn6856_firmware qcn5164 qca9558 qca6574 csr8811_firmware wcd9380 qualcomm215 qcn5054_firmware qcs410 qcn5024 ipq4019_firmware qca8072_firmware qca9985 qcn9012_firmware wcd9335_firmware qcn5052_firmware wcn3980 ipq6018_firmware qcs605 wcd9340_firmware wsa8815 wcn6850 pmp8074_firmware wcn3910 qca6320 qca9986_firmware qca6426_firmware wcn3660b_firmware qca9984 ipq6028 ipq8064 qcn9024 pmp8074 wcn3980_firmware qcn5550_firmware sdx55m ipq8064_firmware wcn6740_firmware qcn5064_firmware ar8031_firmware ipq8078_firmware qcn5054 qrb5165 wcn6851_firmware qcs603 ipq8070 qcn5502 qca9994 qca9980 qcn9024_firmware ipq8174_firmware qca6564a_firmware qca9880 qcm4290_firmware sd480 sd870 wcn6855 sd210_firmware qcs610_firmware qsm8250 sa6145p ipq6018 qca9886_firmware ar8031 apq8096au qcs405_firmware sa8145p qca6391_firmware qca4024 wcd9370_firmware sd780g_firmware sdx55 sd888_firmware qcn5021_firmware sa8155p csra6640 qca9531_firmware ar8035_firmware qcm2290 qsm8250_firmware qcn5024_firmware wcn3991_firmware mdm9150_firmware wsa8830 qcn9070 sa8145p_firmware qcs2290_firmware qca9563_firmware csra6620 qca9987 qcn9072 qca9880_firmware qca9992 qcs4290 sd765g_firmware ipq8069_firmware qca6390_firmware ipq6000 wcd9370 ipq8072 qcn5152_firmware qca6426 wcn3990_firmware qrb5165n_firmware qcn9000_firmware qca9984_firmware qca9377 ipq5018 wcd9385_firmware sdxr2_5g_firmware qca9563 ipq8074a sd662 qcn5124_firmware sa8155 qca6320_firmware qcn5122_firmware sdx55_firmware qca6595au qcn6023_firmware wcn3999_firmware sm7250p_firmware wcn3610_firmware qca6436_firmware qrb5165n ipq5010 qca6564au_firmware sd778g sa6155p_firmware sm6225 ipq8174 qca9990 qcs6490 sdxr2_5g qcn5052 wcn3988_firmware qcn9074 sd205 sa6145p_firmware sd778g_firmware sa8195p wsa8810_firmware sd765_firmware wcd9335 qca8081 qcn6023 ipq8071a qca6174a_firmware ipq8071a_firmware qcs4290_firmware wcd9385 qcs6490_firmware qca6390 qca9898_firmware wcd9375 ar8035 csr8811 ipq4019 qcn9100_firmware sda429w sd210 wcn3620_firmware ipq5010_firmware ipq8074a_firmware sd888_5g_firmware wsa8815_firmware qcm6490 wcn6850_firmware wsa8835_firmware wcn3620 qca6564a qca9988 qca8072 qcm2290_firmware wcn3990 qcn9000 sd780g sd865_5g ar9380_firmware qcn9012 sd888 qca9558_firmware qcn6122_firmware ipq8065_firmware wsa8835 sd665_firmware sd888_5g qcn5154 qca8075_firmware ipq4018 qca6574a wcn6855_firmware qca9889 qca6174a sm7325p qca9888 ipq8074 qca9994_firmware wcn6750 ipq8070a_firmware ipq8076_firmware qca6574_firmware qca9886 qcn5502_firmware sm7325p_firmware sd665 ipq8076 sd765 qca6574a_firmware qcn5021 ipq8069 qcn5152 sd768g_firmware sm7315 sd460 qca6391 qcn9100 sdx65_firmware qcm4290 qcm6490_firmware qcn9070_firmware sd480_firmware ipq6028_firmware ipq8072a_firmware sm6225_firmware qca9531 ipq8074_firmware qca6574au qca9889_firmware sa8155p_firmware qcn5122 sd205_firmware wcd9341_firmware wsa8810 mdm9150 wcn6856 qcn5022 sd768g ipq6010_firmware wcn6740 qca6696 sa6150p qca8075 qcn9022_firmware apq8096au_firmware qcn6024 qcn9022 qca9990_firmware ipq8070a qcn9072_firmware sm7250p ipq6000_firmware sdx12 ipq8071_firmware qcs410_firmware qcn9074_firmware ipq4029 Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.04% / 12.32%

||

7 Day CHG~0.00%

Published-12 Nov, 2021 | 06:15

Updated-03 Aug, 2024 | 22:24

Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Vendor-Qualcomm Technologies, Inc.

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.04% / 11.46%

||

7 Day CHG~0.00%

Published-09 Sep, 2021 | 07:35

Updated-03 Aug, 2024 | 16:25

A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

Vendor-Qualcomm Technologies, Inc.

Product-wcn3991_firmware wcn3991 sda429w_firmware wcd9380_firmware sa6150p_firmware wsa8830 sa8145p_firmware sd780g qca6595 wcn6856_firmware wsa8835 wcd9380 sa8150p_firmware sd888_5g qca6595au_firmware wcd9370 qca6574a wcn6855_firmware sm7325 wcn3980 wcn6750 wcd9385_firmware wcn3660b wcn6850 wcn3660b_firmware sa8155 qca6574a_firmware qca6574au_firmware qca6595au wcd9375_firmware wcn3980_firmware wcn3610_firmware wcn6740_firmware sd778g sa6155p_firmware sd480_firmware sa8155_firmware wcn6851_firmware wcn3988_firmware qca6574au sa6145p_firmware sa8155p_firmware sd778g_firmware sa8195p wcd9341_firmware sd480 wcn6855 wcn6851 sa6155p wcn6856 sa6145p wcd9385 wcd9341 qca6696_firmware qca6595_firmware sa8145p wcn6740 qca6696 wcd9375 sd780g_firmware wcd9370_firmware sa8150p sa6150p sa8155p wsa8830_firmware sda429w wcn3620_firmware wcn3988 sd888_5g_firmware wsa8835_firmware wcn3620 wcn6850_firmware sa8195p_firmware wcn6750_firmware wcn3610 sm7325_firmware Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.03% / 10.46%

||

7 Day CHG~0.00%

Published-09 Jun, 2021 | 06:20

Updated-03 Aug, 2024 | 16:25

Possible use after free in Display due to race condition while creating an external display in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Vendor-Qualcomm Technologies, Inc.

Product-qca9377_firmware wcd9360_firmware mdm9650 sd_636 csra6620 wcn3950_firmware mdm9250 qca6420_firmware qca6595au_firmware qca6390_firmware apq8009_firmware qca6335 sa6155 sd_455_firmware csra6620_firmware qcs605_firmware sd675_firmware wcd9370 csra6640_firmware sd632 wcn3990_firmware qca9377 wcn3998 sdw2500_firmware sd_8cx_firmware whs9410 wcn3950 wcd9326_firmware wcn3615_firmware mdm9206_firmware wcn3660b sd450_firmware sd710_firmware qca4020 sa8155 qca6320_firmware qca6574au_firmware sdx55_firmware wcn3680b_firmware qca6595au sa6155_firmware wcd9375_firmware wcn3615 msm8909w wcn3998_firmware apq8009w_firmware qca6420 apq8053_firmware wcd9360 wcn3610_firmware sdx20m qca6564au_firmware sa6155p_firmware qca6310 qca9367_firmware whs9410_firmware wcn3999 sd429 qca9367 sa8155_firmware sdm630 qcs405 qca6430 sd429_firmware sd712_firmware wcd9340 sdm830_firmware apq8017_firmware wsa8810_firmware qualcomm215_firmware qca4020_firmware wcd9326 wcd9335 sa6155p qcs603_firmware qca6174a_firmware mdm9250_firmware wcn3660_firmware wcd9341 qca6696_firmware qca6390 wcd9375 sd_8cx aqt1000 apq8064au msm8953_firmware sd855_firmware sd660 wcn3620_firmware sdx20_firmware sd712 wsa8815_firmware sd660_firmware wcn3620 apq8017 qca6564a sd450 wcn3610 wcn3990 wcd9330 msm8996au_firmware qca6595 qca6564au sdx55m_firmware msm8909w_firmware qca6574 msm8996au sd632_firmware sd670_firmware wcn3999_firmware qualcomm215 qca6574a sdx50m_firmware mdm9206 qca9379_firmware qca6174a qca6310_firmware qca6430_firmware wcd9335_firmware wcn3980 sd439_firmware qca6335_firmware qca6574_firmware qcs605 wcd9340_firmware sd855 wsa8815 qca6320 mdm9650_firmware qca6175a wcn3660b_firmware wcn3680 qca6574a_firmware sd835 wcn3980_firmware apq8009 wcd9330_firmware sdx55m aqt1000_firmware msm8953 apq8064au_firmware ar8031_firmware sdx50m wcn3680_firmware sdx20 qcs603 sd_455 qca6574au sa8155p_firmware sd710 sd_636_firmware sd670 qca6564a_firmware apq8009w wcd9341_firmware sdx20m_firmware wsa8810 wcn3680b sd835_firmware apq8096au ar8031 qca6595_firmware qcs405_firmware qca6696 sdm630_firmware sd845_firmware wcd9370_firmware sdw2500 sdx55 apq8053 apq8096au_firmware csra6640 sa8155p sd675 sd845 sd439 sdm830 wcn3660 qca9379 qca6175a_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.03% / 10.30%

||

7 Day CHG~0.00%

Published-12 Jun, 2018 | 20:00

Updated-16 Sep, 2024 | 20:43

Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, when more than one HLOS client loads the same TA, a Use After Free condition can occur.

Vendor-Qualcomm Technologies, Inc.Google LLC

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.02% / 7.01%

||

7 Day CHG~0.00%

Published-18 Sep, 2018 | 18:00

Updated-05 Aug, 2024 | 08:17

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, LUT configuration is passed down to driver from userspace via ioctl. Simultaneous update from userspace while kernel drivers are updating LUT registers can lead to race condition.

Vendor-Qualcomm Technologies, Inc.Google LLC

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.01% / 2.06%

||

7 Day CHG~0.00%

Published-05 Dec, 2017 | 17:00

Updated-13 May, 2026 | 00:24

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the camera driver, the function "msm_ois_power_down" is called without a mutex and a race condition can occur in variable "*reg_ptr" of sub function "msm_camera_config_single_vreg".

Vendor-Google LLC Qualcomm Technologies, Inc.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.03% / 9.96%

||

7 Day CHG~0.00%

Published-25 Jul, 2019 | 16:33

Updated-04 Aug, 2024 | 18:49

Race condition while accessing DMA buffer in jpeg driver in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM660, SDX20, SDX24

Vendor-Qualcomm Technologies, Inc.

Product-sd_427_firmware sd_712 sd_850 sd_820a msm8996au_firmware sdx20 sd_670_firmware sd_425 sdm660 sdx24 sd_430_firmware sd_710_firmware sd_435 sd_636 sd_625 msm8909w_firmware sd_820_firmware msm8996au sd_636_firmware sd_820 sd_450_firmware sd_845_firmware sd_820a_firmware qcs605_firmware sd_425_firmware sd_850_firmware sdx24_firmware sd_625_firmware sd_450 sd_712_firmware sda660_firmware sd_845 sd_427 qcs605 sd_430 sd_670 sd_435_firmware sd_835_firmware sd_710 sdx20_firmware sd_835 sda660 msm8909w sdm660_firmware Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.05% / 15.74%

||

7 Day CHG~0.00%

Published-06 Jul, 2018 | 19:00

Updated-16 Sep, 2024 | 18:39

Due to a race condition in the MDSS MDP driver in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-07-05, a Use After Free condition can occur.

Vendor-Qualcomm Technologies, Inc.Google LLC

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.05% / 15.74%

||

7 Day CHG~0.00%

Published-06 Jul, 2018 | 19:00

Updated-16 Sep, 2024 | 16:43

A race condition exists in a driver in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-05-05 potentially leading to a use-after-free condition.

Vendor-Qualcomm Technologies, Inc.Google LLC

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-416

Use After Free

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.01% / 2.06%

||

7 Day CHG~0.00%

Published-05 Dec, 2017 | 17:00

Updated-13 May, 2026 | 00:24

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a multimedia driver can potentially lead to a buffer overwrite.

Vendor-Google LLC Qualcomm Technologies, Inc.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.01% / 3.11%

||

7 Day CHG~0.00%

Published-05 Dec, 2017 | 17:00

Updated-13 May, 2026 | 00:24

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a Camera driver can lead to a Use After Free condition.

Vendor-Google LLC Qualcomm Technologies, Inc.

Product-android Android for MSM, Firefox OS for MSM, QRD Android

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE ID-CWE-416

Use After Free

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 12.23%

||

7 Day CHG~0.00%

Published-06 Aug, 2025 | 07:26

Updated-19 Aug, 2025 | 13:08

Time-of-check Time-of-use (TOCTOU) Race Condition in Display

Memory corruption while processing simultaneous requests via escape path.

Vendor-Qualcomm Technologies, Inc.

Product-qcm6490_firmware snapdragon_8cx_gen_3_compute_platform_\(sc8280xp-bb\)aqt1000 snapdragon_8cx_gen_3_compute_platform_\(sc8280xp-ab\)_firmware snapdragon_7c\+_gen_3_compute_firmware sm6250 snapdragon_7c_compute_platform_\(sc7180-ac\)wsa8835 qca6391 snapdragon_8cx_gen_2_5g_compute_platform_\(sc8180xp-aa\)snapdragon_8cx_gen_3_compute_platform_\(sc8280xp-ab\)fastconnect_7800_firmware wsa8845_firmware sc8180x\+sdx55_firmware wsa8830 snapdragon_8cx_gen_2_5g_compute_platform_\(sc8180x-ac\)_firmware wsa8845h_firmware snapdragon_8c_compute_platform_\(sc8180xp-ad\)snapdragon_8cx_gen_2_5g_compute_platform_\(sc8180xp-ab\)_firmware qca6430 qcs6490_firmware snapdragon_8cx_compute_platform_\(sc8180x-aa\)wsa8815_firmware video_collaboration_vc3_platform_firmware wsa8810 qca6420 snapdragon_8cx_gen_2_5g_compute_platform_\(sc8180x-ac\)wcd9370_firmware snapdragon_8c_compute_platform_\(sc8180x-ad\)fastconnect_6800 snapdragon_8cx_compute_platform_\(sc8180x-ab\)_firmware fastconnect_6200_firmware wsa8840_firmware wsa8810_firmware wcd9380_firmware wsa8835_firmware snapdragon_7c_gen_2_compute_platform_\(sc7180-ad\)_\"rennell_pro\"_firmware wcd9341 snapdragon_8cx_compute_platform_\(sc8180xp-ac\)_firmware wcd9370 sm6250_firmware aqt1000_firmware qcm5430_firmware snapdragon_8cx_compute_platform_\(sc8180xp-af\)wcd9385 snapdragon_8cx_gen_3_compute_platform_\(sc8280xp-bb\)_firmware fastconnect_6800_firmware snapdragon_7c\+_gen_3_compute wsa8840 wcd9375_firmware sc8180x\+sdx55 wcd9385_firmware wsa8815 wcd9341_firmware snapdragon_8cx_compute_platform_\(sc8180xp-ac\)fastconnect_6700_firmware fastconnect_7800 snapdragon_8cx_gen_2_5g_compute_platform_\(sc8180xp-ab\)qcs5430 snapdragon_8c_compute_platform_\(sc8180xp-ad\)_firmware wsa8845h sc8380xp wcd9340 qcm6490 qcs5430_firmware fastconnect_6900_firmware snapdragon_7c_gen_2_compute_platform_\(sc7180-ad\)_\"rennell_pro\"snapdragon_8cx_gen_2_5g_compute_platform_\(sc8180x-af\)_firmware fastconnect_6700 qca6430_firmware snapdragon_8c_compute_platform_\(sc8180x-ad\)_firmware wsa8845 fastconnect_6900 qcs6490 wcd9375 video_collaboration_vc3_platform snapdragon_8cx_compute_platform_\(sc8180xp-af\)_firmware sc8380xp_firmware snapdragon_8cx_gen_2_5g_compute_platform_\(sc8180x-af\)wcd9340_firmware qcm5430 snapdragon_8cx_compute_platform_\(sc8180x-aa\)_firmware snapdragon_8cx_compute_platform_\(sc8180x-ab\)qca6391_firmware wsa8830_firmware wcd9380 snapdragon_7c_compute_platform_\(sc7180-ac\)_firmware fastconnect_6200 qca6420_firmware snapdragon_8cx_gen_2_5g_compute_platform_\(sc8180xp-aa\)_firmware Snapdragon

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.02% / 5.54%

||

7 Day CHG~0.00%

Published-09 Jun, 2021 | 06:20

Updated-04 Aug, 2024 | 11:28

While waiting for a response to a callback or listener request, non-secure clients can change permissions to shared memory buffers used by HLOS Invoke Call to secure kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

Vendor-Qualcomm Technologies, Inc.

Product-qca9377_firmware wcn3991_firmware wsa8830 sd678 sm6250p_firmware qcs610 qcs2290_firmware qca8337 qca6431_firmware sd7c_firmware mdm9628_firmware wcd9360_firmware csra6620 qcs4290 wcn3950_firmware sc8180x\+sdx55 sd765g_firmware qca6420_firmware qca6595au_firmware qcs2290 qca6390_firmware sd690_5g sd730_firmware wcd9370 csra6620_firmware qcs605_firmware sd_675_firmware sd675_firmware csra6640_firmware qcs6125_firmware qca6426 qca6584au_firmware wcn3990_firmware qca9984_firmware qca9377 sa415m wcn3998 sd_8cx_firmware wcd9371_firmware sdxr2_5g_firmware wcd9385_firmware sm4125 mdm9628 sd720g mdm9206_firmware wcd9326_firmware wcn3950 whs9410 sd662 sd710_firmware sd460_firmware sa8155 qca6574au_firmware sdx55_firmware qca6595au wcd9375_firmware wcn3998_firmware wcn3999_firmware sm7250p_firmware qca6420 qca6436_firmware wcd9360 qca6564au_firmware qca6584au sa6155p_firmware qca9367_firmware wcd9306 whs9410_firmware wcn3999 sa515m_firmware sdxr2_5g qca9367 qcs6125 sa8155_firmware qca4004_firmware sd662_firmware sa415m_firmware qcs405 qca6430 wcn3988_firmware qca6421 sd712_firmware sm6250 wcd9306_firmware sa8195p sdm830_firmware wcd9340 wsa8810_firmware sd765g sd765_firmware qca6436 wcd9326 wcd9335 sa6155p wcn6851 qcs603_firmware qcs4290_firmware wcd9385 wcd9341 qca6431 qca6696_firmware wcd9371 sd750g sd870_firmware ar8035 qca6390 sd_8cx aqt1000 sd750g_firmware wcd9375 sc8180x\+sdx55_firmware sm6250_firmware wcn3910_firmware qca4004 wsa8830_firmware sd855_firmware sd865_5g_firmware sd712 sd888_5g_firmware wcn3988 wcn6850_firmware wsa8815_firmware wsa8835_firmware sa8195p_firmware qca6564a wcn6750_firmware qcm6125_firmware qcm2290_firmware wcn3991 qca8337_firmware wcd9380_firmware wcn3990 sd_675 wcd9330 sd865_5g qca6595 qca6564au sdx24 sdx55m_firmware sd670_firmware wsa8835 sd665_firmware wcd9380 sd888_5g sm6250p qcs410 qca6574a sd690_5g_firmware sdx50m_firmware mdm9206 sdx24_firmware qca6430_firmware wcd9335_firmware wcn3980 wcn6750 mdm9205 sa515m qcs605 wcd9340_firmware sd855 sm4125_firmware wcn6850 sd665 sd7c wcn3910 wsa8815 sd_8c_firmware sd765 qca6426_firmware qca6574a_firmware qca9984 sd768g_firmware wcn3980_firmware sd460 qca6391 sd730 sdx55m sdxr1_firmware wcd9330_firmware qca6421_firmware aqt1000_firmware sd678_firmware ar8031_firmware qcm4290 sdx50m sd480_firmware qcs603 wcn6851_firmware qca6574au sa8155p_firmware sd710 sd670 qca6564a_firmware wcd9341_firmware qcm6125 qcm4290_firmware sd480 sd870 wsa8810 qcs610_firmware qsm8250 sd_8c sdxr1 sd768g ar8031 qca6595_firmware qcs405_firmware qca6696 mdm9205_firmware qca6391_firmware wcd9370_firmware sdx55 sa8155p csra6640 sd675 sm7250p sdm830 sd720g_firmware qcs410_firmware ar8035_firmware qcm2290 qsm8250_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7||HIGH

EPSS-0.03% / 7.63%

||

7 Day CHG~0.00%

Published-09 Jun, 2021 | 05:00

Updated-04 Aug, 2024 | 11:28

Time-of-check time-of-use race condition While processing partition entries due to newly created buffer was read again from mmc without validation in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Vendor-Qualcomm Technologies, Inc.

Product-qfe3100 qca9377_firmware pm8909 qfe1040 qfe2550 mdm9640_firmware pm660 pmd9607_firmware pmi8996 pmi632 qfe1040_firmware qfe1045 mdm9628_firmware qfe2340_firmware mdm9650 qln1030 smb1360_firmware pmk8001 qfe2340 mdm9250 smb1358_firmware pmd9635_firmware apq8009_firmware qca6174_firmware qcc1110_firmware apq8076 wtr3905 wtr5975_firmware apq8076_firmware qca9377 pmi632_firmware sdw2500_firmware wcd9326_firmware mdm9628 wcn3615_firmware mdm9206_firmware qsw8573_firmware rgr7640au_firmware wtr2955 wcn3660b wgr7640_firmware qln1021aq qcc112 qca4020 mdm9230_firmware pm8953_firmware qca6574au_firmware qca6584 mdm9630 qln1031_firmware wcn3615 wcn3680b_firmware msm8909w apq8009w_firmware wcn3610_firmware apq8053_firmware sdx20m qca6564au_firmware wcd9306 qca9367_firmware pm8937 pm660_firmware pm8996 qca9367 mdm9607_firmware mdm9655_firmware qcc1110 smb1360 sd205 wcd9306_firmware apq8017_firmware wsa8810_firmware pm8953 qualcomm215_firmware smb231 pm439_firmware qca4020_firmware wcd9326 wcd9335 qet4200aq qfe1045_firmware msm8937 qfe3345 pm8004_firmware qca6174a_firmware mdm9250_firmware smb1358 pm439 pmi8952 mdm9655 pm8937_firmware qet4100_firmware smb1350 qfe2550_firmware pm8952_firmware mdm9330_firmware sd210 wcn3620_firmware sd820 sdx20_firmware wsa8815_firmware pmi8937 wcn3620 sdw3100 wtr3925_firmware wtr3925 sdw3100_firmware apq8017 qcc112_firmware csr6030_firmware qca6564a mdm9630_firmware qet4100 wcn3610 mdm9640 pmi8952_firmware qfe3335_firmware smb1355 wcd9330 msm8996au_firmware wtr2955_firmware wgr7640 csr6030 qca6564au pmi8994_firmware pmm8996au_firmware qet4101_firmware msm8909w_firmware msm8996au pmk8001_firmware qfe1035 pmm8996au smb1355_firmware smb1351_firmware pmd9655_firmware rgr7640au mdm9230 qualcomm215 pm8996_firmware qet4200aq_firmware pm8909_firmware qca6574a mdm9206 pm8916_firmware qca9379_firmware qca6174a qfe3100_firmware smb358s_firmware smb358s wtr4905 wtr5975 qca6174 wcd9335_firmware qtc801s_firmware sd439_firmware pmd9645 pm8956_firmware qsw8573 qfe3335 qln1036aq_firmware wsa8815 qca6584_firmware msm8937_firmware mdm9650_firmware wcn3660b_firmware wcn3680 pmx20 pmd9607 qca6574a_firmware apq8009 qfe3320_firmware smb1351 smb1357_firmware wcd9330_firmware wtr3905_firmware pm215_firmware mdm9626 wtr2965_firmware qfe1035_firmware wcn3680_firmware sdx20 qln1021aq_firmware pm8916 qln1036aq qtc801s pmd9635 mdm9626_firmware pmd9655 qca6574au qfe3320 mdm9607 sd205_firmware qca6564a_firmware apq8009w pmd9645_firmware sdx20m_firmware wsa8810 smb231_firmware wtr4905_firmware sd210_firmware qfe3345_firmware wcn3680b pm215 apq8096au qln1030_firmware smb1350_firmware wtr2965 sd820_firmware pmi8996_firmware pmx20_firmware pmi8937_firmware pm8004 sdw2500 apq8053 apq8096au_firmware sd439 qet4101 pm8952 pmi8994 smb1357 mdm9330 qca9379 pm8956 qln1031 Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 16.75%

||

7 Day CHG~0.00%

Published-03 Jun, 2025 | 05:53

Updated-26 Feb, 2026 | 18:27

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.

Vendor-Qualcomm Technologies, Inc.

Product-sw5100p sm8735_firmware fastconnect_6900_firmware sw5100p_firmware wsa8845_firmware wcn7880_firmware wsa8832_firmware sm8750p_firmware wcd9390 wsa8835 sw5100_firmware wsa8830_firmware wcd9395 wsa8845 wsa8840 sxr2330p fastconnect_7800 wsa8845h_firmware fastconnect_7800_firmware snapdragon_8_gen_3_mobile_platform_firmware sm8750 wsa8830 snapdragon_w5\+_gen_1_wearable_platform_firmware wcn7880 wsa8832 snapdragon_w5\+_gen_1_wearable_platform sw5100 wcd9378 wsa8835_firmware wcn7860 fastconnect_6900 wcd9385 wcd9385_firmware sm8735 sxr2230p sm8750p snapdragon_8_gen_3_mobile_platform sxr2250p wcn7861_firmware wsa8840_firmware wcn7750 sxr2230p_firmware qmp1000 wcn7881 sxr2250p_firmware wcn7860_firmware sm8750_firmware qmp1000_firmware wcd9378_firmware wsa8845h sxr2330p_firmware wcd9390_firmware wcd9380_firmware wcd9395_firmware wcn7861 wcn7750_firmware wcd9380 wcn7881_firmware Snapdragon

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.04% / 12.23%

||

7 Day CHG~0.00%

Published-06 Aug, 2025 | 07:25

Updated-26 Feb, 2026 | 17:49

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux

Memory corruption when using Virtual cdm (Camera Data Mover) to write registers.

Vendor-Qualcomm Technologies, Inc.

Product-Snapdragon

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 16.75%

||

7 Day CHG~0.00%

Published-06 Aug, 2025 | 07:25

Updated-26 Feb, 2026 | 17:49

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux

Memory corruption while submitting blob data to kernel space though IOCTL.

Vendor-Qualcomm Technologies, Inc.

Product-fastconnect_6800_firmware sw5100p_firmware fastconnect_6900_firmware snapdragon_8_gen_1_mobile_platform_firmware sw5100p qca6391_firmware wsa8815_firmware wsa8832_firmware snapdragon_xr2_5g_platform wsa8810_firmware snapdragon_870_5g_mobile_platform_\(sm8250-ac\)sw5100_firmware sxr2130 wcn3980_firmware wsa8830_firmware wsa8835 fastconnect_7800 sd865_5g snapdragon_870_5g_mobile_platform_\(sm8250-ac\)_firmware sdx55_firmware fastconnect_7800_firmware qca6391 wsa8830 wsa8832 sw5100 fastconnect_6800 wcn3980 wcn3988_firmware snapdragon_865_5g_mobile_platform_firmware wcn3988 qca6426_firmware snapdragon_8_gen_1_mobile_platform wsa8835_firmware snapdragon_x55_5g_modem-rf_system_firmware fastconnect_6900 sd865_5g_firmware wcd9385 wcd9385_firmware qsm8250 snapdragon_865\+_5g_mobile_platform_\(sm8250-ab\)snapdragon_xr2_5g_platform_firmware sxr2230p sxr2250p sdx55 qca6426 qca6436 sxr2230p_firmware sxr2250p_firmware snapdragon_865_5g_mobile_platform wsa8815 snapdragon_x55_5g_modem-rf_system wsa8810 qsm8250_firmware wcd9380_firmware qca6436_firmware snapdragon_865\+_5g_mobile_platform_\(sm8250-ab\)_firmware wcd9380 sxr2130_firmware Snapdragon

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.12% / 30.03%

||

7 Day CHG~0.00%

Published-07 Apr, 2025 | 10:15

Updated-19 Aug, 2025 | 16:59

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform

Information disclosure may be there when a guest VM is connected.

Vendor-Qualcomm Technologies, Inc.

Product-sa7775p sa8620p srv1h_firmware sa7255p qca6595au_firmware sa8540p_firmware qamsrv1m_firmware sa6145p_firmware sa8255p sa6155p_firmware sa8195p qca6698aq sa8295p sa8145p_firmware sa8155_firmware sa8295p_firmware sa8150p sa8775p sa6150p_firmware qam8295p_firmware qam8620p qca6574au_firmware sa8145p qamsrv1m sa6155_firmware sa8540p sa8770p sa6150p srv1m_firmware qca6696 qamsrv1h_firmware qca6574au sa8775p_firmware qca6595_firmware qca6688aq_firmware qam8295p sa6155 srv1l_firmware qca6696_firmware sa8770p_firmware sa6155p sa8155 qca6595au qca6574a_firmware srv1h qca6688aq sa6145p qca6574a qamsrv1h qca6595 qam8775p qam8255p qam8650p_firmware sa8255p_firmware qam8620p_firmware sa9000p sa7255p_firmware sa8620p_firmware srv1l sa8650p sa8155p_firmware sa9000p_firmware sa8155p qam8775p_firmware sa8650p_firmware qam8255p_firmware sa7775p_firmware qca6698aq_firmware sa8150p_firmware srv1m qam8650p sa8195p_firmware Snapdragon

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.5||HIGH

EPSS-0.29% / 52.32%

||

7 Day CHG~0.00%

Published-14 Jun, 2022 | 09:40

Updated-04 Aug, 2024 | 00:33

Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile

Vendor-Qualcomm Technologies, Inc.

Product-wcn3991_firmware wcn3991 qca8337_firmware wcd9380_firmware wsa8830 qca8337 sd865_5g sdx55m_firmware wcn6856_firmware sdx65 wsa8835 wcd9380 sd765g_firmware sd888_5g qca6390_firmware wcd9370 wcn6855_firmware wcn6750 wcn3998 wcd9385_firmware sd_8_gen1_5g_firmware wsa8815 wcn6850 sd765 sd768g_firmware sdx55_firmware wcd9375_firmware qca8081_firmware wcn3998_firmware sm7250p_firmware qca6391 sdx55m sm8475_firmware sm7450_firmware sd778g sdx65_firmware wcn7851 wsa8832_firmware wcn6851_firmware sd778g_firmware wsa8810_firmware sd765g wcd9341_firmware wsa8810 sd765_firmware sd870 wcn6855 wcn6851 wsa8832 qca8081 wcn7851_firmware wcn6856 wcd9385 wcd9341 sd768g sd870_firmware qca6391_firmware qca6390 ar8035 wcd9370_firmware wcd9375 wcn6750_firmware sdx55 wsa8830_firmware sd865_5g_firmware wsa8815_firmware sd888_5g_firmware sm7250p wcn6850_firmware wsa8835_firmware sm7450 sm8475 sm8475p_firmware ar8035_firmware sm8475p Snapdragon Connectivity, Snapdragon Mobile

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE ID-CWE-20

Improper Input Validation

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-9.3||CRITICAL

EPSS-0.09% / 24.77%

||

7 Day CHG~0.00%

Published-14 Jun, 2022 | 09:51

Updated-04 Aug, 2024 | 00:33

Possible hypervisor memory corruption due to TOC TOU race condition when updating address mappings in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Vendor-Qualcomm Technologies, Inc.

Product-wcn3991_firmware wcn3991 wsa8830 wcd9380_firmware sd780g sd865_5g qca6431_firmware sdx55m_firmware wcn6856_firmware sd888 wsa8835 sa8540p_firmware wcd9380 sd765g_firmware sd888_5g qca6420_firmware qca6390_firmware sd690_5g wcd9370 sd690_5g_firmware wcn6855_firmware sm7325p qca6426 qrb5165n_firmware qca6430_firmware wcn6750 wcn3998 sd_8cx_firmware wcd9385_firmware sdxr2_5g_firmware sd_8cx_gen2_firmware sa9000p wcd9340_firmware wsa8815 sm7325p_firmware qsm8350_firmware wcn6850 qsm8350 sd765 qca6426_firmware sa9000p_firmware sm7315_firmware wcn7850 sd768g_firmware wcd9375_firmware wcn3998_firmware qrb5165m sm7315 sm7250p_firmware qca6391 sdx55m qca6420 qca6436_firmware qrb5165n qca6421_firmware aqt1000_firmware wcn6740_firmware sd778g sd_8cx_gen2 wcn7851 qcs6490 qrb5165_firmware qrb5165m_firmware sdxr2_5g qcm6490_firmware qrb5165 wcn6851_firmware wcn3988_firmware qca6430 qca6421 sd778g_firmware wcd9340 wsa8810_firmware sd765g wcd9341_firmware wsa8810 sd765_firmware sd870 qca6436 wcn6851 wcn6855 sa8540p wcn7851_firmware wcn6856 wcd9385 wcd9341 sd768g qca6431 qcs6490_firmware sd750g sd870_firmware wcn6740 qca6391_firmware qca6390 wcd9375 sd_8cx aqt1000 sd750g_firmware sd780g_firmware wcd9370_firmware sd888_firmware wsa8830_firmware sd865_5g_firmware qcm6490 sd888_5g_firmware wcn3988 wcn6850_firmware wcn7850_firmware wsa8815_firmware wsa8835_firmware sm7250p wcn6750_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-9.1||CRITICAL

EPSS-0.23% / 45.95%

||

7 Day CHG~0.00%

Published-14 Jun, 2022 | 09:50

Updated-04 Aug, 2024 | 00:33

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapdragon Industrial IOT

Vendor-Qualcomm Technologies, Inc.

Product-mdm9206 qca9377_firmware qca9367_firmware qca9377 qca9367 mdm9206_firmware Snapdragon Industrial IOT

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-9.1||CRITICAL

EPSS-0.18% / 38.99%

||

7 Day CHG~0.00%

Published-14 Jun, 2022 | 10:11

Updated-03 Aug, 2024 | 22:32

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Vendor-Qualcomm Technologies, Inc.

Product-wcn3991_firmware wsa8830 sd678 sm6250p_firmware qca8337 wcd9360_firmware sdx65 wcn3950_firmware sd765g_firmware qca6595au_firmware qca6390_firmware sd690_5g sd730_firmware wcd9370 sd_675_firmware sd675_firmware qca6426 wcn3998 wcd9385_firmware sdxr2_5g_firmware wcn3950 sd720g sd_8_gen1_5g_firmware sm6375_firmware sm7315_firmware qca6574au_firmware sdx55_firmware qca6595au qca8081_firmware wcd9375_firmware wcn3998_firmware sm7250p_firmware wcd9360 qca6436_firmware sd778g sa515m_firmware qcs6490 sdxr2_5g wcn3988_firmware sm6250 sd778g_firmware wsa8810_firmware sd765g sd765_firmware qca6436 wcn6851 qca8081 wcd9385 wcd9341 qca6696_firmware qcs6490_firmware sd750g sd870_firmware qca6390 ar8035 sd750g_firmware wcd9375 sm6250_firmware wsa8830_firmware sd865_5g_firmware qcm6490 sd888_5g_firmware wcn3988 wcn6850_firmware wsa8815_firmware wsa8835_firmware qcx315 sm8475 wcn6750_firmware sm6375 wcn3991 qca8337_firmware wcd9380_firmware sd_675 sd780g sd865_5g sdx55m_firmware wcn6856_firmware sd888 wsa8835 qcx315_firmware wcd9380 sd888_5g sm6250p qca6574a sd690_5g_firmware wcn6855_firmware sm7325p wcn3980 wcn6750 sa515m wsa8815 sm7325p_firmware wcn6850 sd765 qca6426_firmware qca6574a_firmware sd768g_firmware wcn3980_firmware sm7315 sd730 qca6391 sdx55m wcn6740_firmware sdx65_firmware sd678_firmware qcm6490_firmware sd480_firmware wcn6851_firmware qca6574au wcd9341_firmware sd480 sd870 wsa8810 wcn6855 wcn6856 sd768g wcn6740 qca6696 qca6391_firmware sd780g_firmware wcd9370_firmware sdx55 sd888_firmware sd675 sm7250p sd720g_firmware ar8035_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-9.1||CRITICAL

EPSS-0.17% / 37.51%

||

7 Day CHG~0.00%

Published-14 Jun, 2022 | 10:11

Updated-03 Aug, 2024 | 22:32

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Vendor-Qualcomm Technologies, Inc.

Product-wcn3991_firmware wsa8830 sd678 sm6250p_firmware qca8337 wcd9360_firmware sdx65 wcn3950_firmware sd765g_firmware qca6595au_firmware qca6390_firmware sd690_5g sd730_firmware wcd9370 sd_675_firmware sd675_firmware qca6426 wcn3998 wcd9385_firmware sdxr2_5g_firmware wcn3950 sd720g sd_8_gen1_5g_firmware sm6375_firmware sm7315_firmware qca6574au_firmware sdx55_firmware qca6595au qca8081_firmware wcd9375_firmware wcn3998_firmware sm7250p_firmware wcd9360 qca6436_firmware sd778g sa515m_firmware qcs6490 sdxr2_5g wcn3988_firmware sm6250 sd778g_firmware wsa8810_firmware sd765g sd765_firmware qca6436 wcn6851 qca8081 wcd9385 wcd9341 qca6696_firmware qcs6490_firmware sd750g sd870_firmware qca6390 ar8035 sd750g_firmware wcd9375 sm6250_firmware wsa8830_firmware sd865_5g_firmware qcm6490 sd888_5g_firmware wcn3988 wcn6850_firmware wsa8815_firmware wsa8835_firmware qcx315 sm8475 wcn6750_firmware sm6375 wcn3991 qca8337_firmware wcd9380_firmware sd_675 sd780g sd865_5g sdx55m_firmware wcn6856_firmware sd888 wsa8835 qcx315_firmware wcd9380 sd888_5g sm6250p qca6574a sd690_5g_firmware wcn6855_firmware sm7325p wcn3980 wcn6750 sa515m wsa8815 sm7325p_firmware wcn6850 sd765 qca6426_firmware qca6574a_firmware sd768g_firmware wcn3980_firmware sm7315 sd730 qca6391 sdx55m wcn6740_firmware sdx65_firmware sd678_firmware qcm6490_firmware sd480_firmware wcn6851_firmware qca6574au wcd9341_firmware sd480 sd870 wsa8810 wcn6855 wcn6856 sd768g wcn6740 qca6696 qca6391_firmware sd780g_firmware wcd9370_firmware sdx55 sd888_firmware sd675 sm7250p sd720g_firmware ar8035_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-9.1||CRITICAL

EPSS-0.14% / 34.18%

||

7 Day CHG~0.00%

Published-14 Jun, 2022 | 10:11

Updated-03 Aug, 2024 | 22:32

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables

Vendor-Qualcomm Technologies, Inc.

Product-fsm10055 qca9377_firmware mdm9150_firmware wcn3991_firmware sd678 mdm9640_firmware sa6150p_firmware sa8145p_firmware qcs610 sm6250p_firmware wsa8830 qcs2290_firmware fsm10056 sd7c_firmware csrb31024 mdm9628_firmware mdm9650 fsm10055_firmware qcs4290 wcn3950_firmware mdm9250 sa8150p_firmware qca6420_firmware qca6595au_firmware qcs2290 sd730_firmware wcd9370 sd_675_firmware sd675_firmware qcs6125_firmware qca6584au_firmware qca9377 sa415m wcn3998 sdw2500_firmware sd_8cx_gen2_firmware wcn3950 mdm9628 sd720g mdm9206_firmware qsw8573_firmware sd662 sd460_firmware qca6584 qca6574au_firmware qca6595au sdx12_firmware wcd9375_firmware wcn3998_firmware msm8909w apq8009w_firmware qca6420 wcn3610_firmware mdm9207 qca6564au_firmware qca6584au sa6155p_firmware qca9367_firmware sd680_firmware wcd9306 mdm8207 sd_8cx_gen2 sd429 qca9367 qcs6125 qca4004_firmware mdm9607_firmware sd662_firmware mdm9655_firmware sa415m_firmware wcn3988_firmware qca6430 sa6145p_firmware sd205 sd429_firmware sm6250 wcd9306_firmware sa8195p apq8017_firmware sw5100 fsm10056_firmware sd680 sa6155p qca6174a_firmware mdm9250_firmware qcs4290_firmware mdm9655 qca6696_firmware wcn3910_firmware wcd9375 aqt1000 sa8150p sm6250_firmware mdm9207_firmware qca4004 wsa8830_firmware sda429w sd210 sd855_firmware sd660 wcn3620_firmware sdx20_firmware wcn3988 wsa8835_firmware sd660_firmware wcn3620 sa8195p_firmware apq8017 qca6564a wcn3610 qcm6125_firmware mdm9640 qcm2290_firmware wcn3991 sda429w_firmware wcd9380_firmware sd_675 sdm429w msm8996au_firmware sw5100p wcd9330 qca6564au sdx24 msm8909w_firmware qca6574 msm8996au sdm429w_firmware wsa8835 sd665_firmware wcd9380 sd850 sm6250p qcs410 qca6574a mdm9206 qca6174a sdx24_firmware qca6430_firmware sd439_firmware qsw8573 mdm9205 qca6574_firmware sd855 sd665 sd7c wcn3910 qca6584_firmware mdm9650_firmware qca6574a_firmware sd850_firmware sd460 sd730 sdxr1_firmware wcd9330_firmware aqt1000_firmware sd678_firmware qcm4290 csrb31024_firmware sdx20 qca6574au sa8155p_firmware mdm9607 sd205_firmware qca6564a_firmware apq8009w qcm6125 qcm4290_firmware sw5100p_firmware sd210_firmware qcs610_firmware mdm9150 sa6145p sdxr1 apq8096au sa8145p mdm8207_firmware qca6696 mdm9205_firmware wcd9370_firmware sa6150p sdw2500 apq8096au_firmware sa8155p sd675 sd439 sd720g_firmware sdx12 sw5100_firmware qcs410_firmware qcm2290 Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-8.4||HIGH

EPSS-0.04% / 11.77%

||

7 Day CHG~0.00%

Published-17 Oct, 2022 | 00:00

Updated-14 May, 2025 | 15:15

Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Vendor-Qualcomm Technologies, Inc.

Product-sm4375 wcn6855_firmware qca6391_firmware qcs4290 sd888_5g_firmware qca6574_firmware sdx50m_firmware sw5100_firmware qca6430 sa8155 wcn7850_firmware wcd9375_firmware sd855_firmware sm4125 qcm4290_firmware sd680_firmware qca6574au_firmware wcn3990 wsa8835_firmware qca6696_firmware qcs2290 qcs410 sa6145p wcn6855 qam8295p wsa8830 qca6696 sm8475 sd778g_firmware sm7325p wcn3910 sa6155p qca6420 sm4375_firmware wcn3998_firmware wcn6750_firmware sdx55 qca6390_firmware sm7250p qcn7606 wcn6740_firmware sd765 sdx55_firmware sd750g_firmware qca6574a_firmware wcd9385_firmware sa8195p_firmware wcn3950_firmware wsa8815_firmware sd439 qcm6490 sd678 qcs410_firmware sd660_firmware sd660 qcs6125 sa4155p sa6145p_firmware wcd9335 qca6430_firmware sd675_firmware qcs2290_firmware aqt1000 qca6391 wcd9370_firmware sa8295p wcn3991_firmware sa8295p_firmware sd662 wsa8835 sa8195p sm7250p_firmware wcn6851_firmware sd768g_firmware wcn3980_firmware sd480_firmware sm7315_firmware qca6574a qcs610 wcn6750 qca6595au wcn3615_firmware wcn6851 sd690_5g qcs6490_firmware sa4150p sd865_5g wcn6850_firmware sd865_5g_firmware wcn3660b_firmware wsa8830_firmware wcd9341 wcn3660b wcn3991 sd460 wcn3998 qca6574au sd888_firmware sm7315 wcn3990_firmware wcn6856_firmware sdx55m qcm2290_firmware qcm6125_firmware wcd9341_firmware wcn3615 qca6420_firmware sd_675 sa4150p_firmware wcd9335_firmware wsa8815 sd750g wcd9326 sw5100p_firmware sda429w wcn6856 wcn6740 wcn7850 sd690_5g_firmware sda429w_firmware sd_8_gen1_5g_firmware sd460_firmware wcd9380 wcn3988 qcm6125 sa8155p_firmware sd780g_firmware sd870_firmware wcd9326_firmware wcn3988_firmware qca6574 sd870 sd765_firmware wcn7851_firmware sa6150p_firmware qcs6490 sd778g qam8295p_firmware sw5100 sd680 sd_675_firmware qcs6125_firmware sd768g wcn3610_firmware wcn3680b wcn6850 wsa8810 sd855 qcs4290_firmware sa8145p sd439_firmware qcc5100_firmware wcd9380_firmware sd678_firmware sa8145p_firmware sd888_5g sa8155_firmware sd662_firmware sd720g_firmware sd780g sd480 sm6250 qca6390 wcn3910_firmware sd695 qcm4290 sa6155 sa6150p qca6595au_firmware sm4125_firmware wcn3610 qcm2290 sd695_firmware qcm6490_firmware wsa8810_firmware sd730_firmware sdx55m_firmware sm6250_firmware wcd9375 wcd9370 sa8150p_firmware wcn7851 qcn7606_firmware wcd9385 sa6155p_firmware sa8150p sd765g wcn3950 sw5100p sd730 sa6155_firmware aqt1000_firmware sd888 sd720g sdx50m sd675 wcn3680b_firmware wcn3980 sm7325p_firmware qcc5100 sa8155p qcs610_firmware sd765g_firmware sa4155p_firmware Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

Matching Score-6

Assigner-Qualcomm, Inc.

Matching Score-6

Assigner-Qualcomm, Inc.

CVSS Score-7.5||HIGH

EPSS-0.20% / 42.11%

||

7 Day CHG-0.08%

Published-04 Apr, 2023 | 04:46

Updated-03 Aug, 2024 | 08:01

Time-of-check time-of-use race condition in Modem

Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message.

Vendor-Qualcomm Technologies, Inc.

Product-sm6375 wsa8830 sm7325-ae_firmware qca8337_firmware wcd9380_firmware qca8337 wcn785x-5 sm8350-ac_firmware wsa8835 snapdragon_auto_5g_modem-rf wcd9380 qca6595au_firmware snapdragon_x70_modem-rf_system sm8350 wcd9370 wcn685x-5_firmware sm7325p wcn685x-1 sm7325 sm8450 wcn6750 sm4375 wcn3998 wcd9385_firmware qcn6024_firmware sm6375_firmware wsa8815 sm7325p_firmware sdx57m_firmware sm7325-af sm7325-ae qcn9024 qca6595au wcn3998_firmware qca8081_firmware sm7325-af_firmware wcd9375_firmware wcn785x-5_firmware qca6391 sm4350-ac sd778g snapdragon_auto_5g_modem-rf_firmware snapdragon_x65_5g_modem-rf_system_firmware snapdragon_x70_modem-rf_system_firmware snapdragon_x65_5g_modem-rf_system qcs6490 qcm6490_firmware qca6698aq sm8350_firmware wcn685x-5 wcn3988_firmware wcn785x-1_firmware sd778g_firmware qcn9024_firmware wsa8810_firmware sdx57m sm4375_firmware sm8450_firmware wsa8810 qca8081 qca6698aq_firmware sm8350-ac wcn685x-1_firmware wcd9385 qca6696_firmware qcs6490_firmware qca6696 qca6391_firmware ar8035 sm4350_firmware wcd9375 sm4350 wcd9370_firmware sm4350-ac_firmware wsa8830_firmware qcn6024 qcm6490 wcn3988 wsa8815_firmware wsa8835_firmware wcn6750_firmware ar8035_firmware wcn785x-1 sm7325_firmware Snapdragon

CWE ID-CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition