Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MSM8953, QCN7605, QCS605, SC8180X, SDA845, SDM429, SDM439, SDM450, SDM632, SDX20, SDX24, SDX55, SM8150, SXR1130
Use after free issue when MAP and UNMAP calls at same time as data structure used my MAP may be freed by UNMAP function in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in Nicobar, QCS405, Rennell, Saipan, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
Memory corruption while transmitting packet mapping information with invalid header payload size.
Memory corruption while processing escape code, when DisplayId is passed with large unsigned value.
Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.
Memory corruption while processing camera TPG write request.
Memory corruption while processing a private escape command in an event trigger.
Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.
Memory corruption while submitting blob data to kernel space though IOCTL.
Memory corruption when using Virtual cdm (Camera Data Mover) to write registers.
Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call.
Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.
Memory corruption while performing private key encryption in trusted application.
Memory corruption while processing memory map or unmap IOCTL operations simultaneously.
Buffer overflow in WLAN driver event handlers due to improper validation of array index in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS405, QCS605, SD 636, SD 675, SD 730, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer.
Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.
Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.
Memory corruption while processing message content in eAVB.
Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
Memory corruption may occur while processing device IO control call for session control.
Multiple stack-based buffer overflows in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to gain privileges via (1) a crafted VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c, or (2) a crafted VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c.
Memory corruption while reading the FW response from the shared queue.
Memory corruption while IOCTL call is invoked from user-space to read board data.
Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.
Memory corruption while calling the NPU driver APIs concurrently.
Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit.
Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.
Memory corruption while processing commands from A2dp sink command queue.
Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
Memory corruption while copying the result to the transmission queue in EMAC.
Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.
Memory corruption when programming registers through virtual CDM.
Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.
Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.
Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously.
Memory corruption may occur due top improper access control in HAB process.
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
Memoru corruption in Audio when ADSP sends input during record use case.
While reading file class type from ELF header, a buffer overread may happen if the ELF file size is less than the size of ELF64 header size in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version FSM9055, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDA660, SDX20.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Memory corruption due to stack-based buffer overflow in Core
Memory corruption due to improper access control in kernel while processing a mapping request from root process.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory corruption in Automotive Android OS due to improper validation of array index.
Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.
Memory corruption in core due to stack-based buffer overflow
Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.
Memory corruption due to improper validation of array index in Audio.