Memory corruption due to configuration weakness in modem wile sending command to write protected files.
Memory corruption due to stack based buffer overflow in core while sending command from USB of large size.
Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.
Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.
Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity.
Memory corruption due to use after free in trusted application environment.
Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory.
Memory corruption in Automotive Android OS due to improper input validation.
Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.
Memory corruption due to double free in core while initializing the encryption key.
Memory corruption in Linux while sending DRM request.
Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries.
Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
Memory corruption may occur while attaching VM when the HLOS retains access to VM.
Memory corruption during the FRS UDS generation process.
Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
Memory corruption can occur during context user dumps due to inadequate checks on buffer length.
u'Out of bound access can happen in MHI command process due to lack of check of channel id value received from MHI devices' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9150, MDM9607, MDM9650, MSM8905, MSM8917, MSM8953, Nicobar, QCA6390, QCA9531, QCM2150, QCS404, QCS405, QCS605, QCS610, QM215, QRB5165, Rennell, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM660, SDM670, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality.
Memory corruption may occur during the synchronization of the camera`s frame processing pipeline.
Memory corruption while power-up or power-down sequence of the camera sensor.
Memory corruption while processing IOCTL from user space to handle GPU AHB bus error.
Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
Memory corruption while processing an IOCTL call to set mixer controls.
Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption can occur in the camera when an invalid CID is used.
Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption while reading secure file.
Memory corruption while processing camera use case IOCTL call.
Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
Memory corruption may occur while validating ports and channels in Audio driver.
Memory corruption occurs during an Escape call if an invalid Kernel Mode CPU event and sync object handle are passed with the DriverKnownEscape flag reset.
Memory corruption may occur in keyboard virtual device due to guest VM interaction.
Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine.
Memory corruption may occur during communication between primary and guest VM.
Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality.
Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.
Memory corruption while doing Escape call when user provides valid kernel address in the place of valid user buffer address.
Memory corruption during concurrent buffer access due to modification of the reference count.
Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session.
Memory corruption when IOCTL call is invoked from user-space to read board data.
Memory corruption while processing input message passed from FE driver.
Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.
Memory corruption during concurrent SSR execution due to race condition on the global maps list.
Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.
Memory corruption while processing command in Glink linux.
Memory corruption while maintaining memory maps of HLOS memory.
Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.