Possible integer overflow in page alignment interface due to lack of address and size validation before alignment in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Possible assertion in QOS request due to improper validation when multiple add or update request are received simultaneously in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Possible stack overflow due to improper length check of TLV while copying the TLV to a local stack variable in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Possible buffer overflow while printing the HARQ memory partition detail due to improper validation of buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Possible integer overflow to buffer overflow due to improper input validation in FTM ARA commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Possible out of bound read due to improper validation of packet length while handling data transfer in VR service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
Memory corruption while allocating memory in HGSL driver.
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.
Possible null pointer dereference in trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Memory corruption when user provides data for FM HCI command control operations.
Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
Memory corruption while processing IOCTL call to set metainfo.
Memory corruption when the captureRead QDCM command is invoked from user-space.
Memory corruption while processing frame command IOCTL calls.
Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
Memory corruption while taking snapshot when an offset variable is set by camera driver.
Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.
Memory corruption while handling user packets during VBO bind operation.
Memory corruption during session sign renewal request calls in HLOS.
Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.
Memory corruption when keymaster operation imports a shared key.
Memory corruption while releasing shared resources in MinkSocket listener thread.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
Memory corruption when the IOCTL call is interrupted by a signal.
Memory corruption when size of buffer from previous call is used without validation or re-initialization.
Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
Memory corruption while processing key blob passed by the user.
Memory corruption while allocating memory for graphics.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
Memory corruption while processing IPA statistics, when there are no active clients registered.