Memory corruption during concurrent access to server info object due to unprotected critical field.
Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations.
Memory corruption while maintaining memory maps of HLOS memory.
Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.
Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization.
Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.
Memory corruption while processing IOCTL call for getting group info.
Memory corruption while processing user packets to generate page faults.
Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.
Memory corruption while processing GPU commands.
Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
Memory corruption while processing frame command IOCTL calls.
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MSM8917, MSM8953, Nicobar, QM215, Rennell, SDM429, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR2130
Memory corruption while releasing shared resources in MinkSocket listener thread.
Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption while handling user packets during VBO bind operation.
Memory corruption when kernel driver attempts to trigger hardware fences.
Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.
Memory corruption while processing graphics kernel driver request to create DMA fence.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption in Kernel while handling GPU operations.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption while handling session errors from firmware.
Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.
Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
Possible use after free due to lack of null check of DRM file status after file structure is freed in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
Memory corruption while encoding JPEG format.
Memory corruption while processing command in Glink linux.
Memory corruption while handling file descriptor during listener registration/de-registration.
Possible use after free in Display due to race condition while creating an external display in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Memory corruption while processing IOCTL calls to unmap the buffers.
Use after free issue in camera applications when used randomly over multiple operations due to pointer not set to NULL after free/destroy of the object in Snapdragon Consumer IOT, Snapdragon Mobile in Kamorta, QCS605, Rennell, Saipan, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.
Memory corruption during GNSS HAL process initialization.
Memory corruption while processing concurrent IOCTL calls.
An issue was discovered on Samsung mobile devices with N(7.x), O(8.0) devices (MSM8998 or SDM845 chipsets) software. An attacker can bypass Secure Boot and obtain root access because of a missing Bootloader integrity check. The Samsung ID is SVE-2018-11552 (May 2018).
Possible Integer underflow in WLAN function due to lack of check of data received from user side in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCN7605, QCS605, SDA845, SDM670, SDM710, SDM845, SDM850, SM8150, SXR1130
Memory corruption in Core Services while executing the command for removing a single event listener.
Memory failure in content protection module due to not having pointer within the scope in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, QCS404, Rennell, SC7180, SDX55, SM6150, SM7150, SM8250, SXR2130
Memory corruption due to stack based buffer overflow in core while sending command from USB of large size.