Certain unprivileged processes are able to perform IOCTL calls.
Memory Corruption in Audio while invoking callback function in driver from ADSP.
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Memory corruption in Core while processing control functions.
Memory corruption in Audio when SSR event is triggered after music playback is stopped.
Memory corruption in Automotive Display while destroying the image handle created using connected display driver.
Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.
Memory corruption in HLOS while running playready use-case.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory corruption in core due to stack-based buffer overflow
Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.
Memory corruption due to improper validation of array index in Audio.
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.
Memory corruption due to stack-based buffer overflow in Core
Memory corruption in Linux Networking due to double free while handling a hyp-assign.
Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.
Memory corruption while running VK synchronization with KASAN enabled.
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.
Memory corruption in wearables while processing data from AON.
Memory corruption while parsing the ADSP response command.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Memory corruption in Core while processing RX intent request.
In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory (substream->runtime->private_data) with a NULL check, such as msm_pcm_volume_ctl_put(), which means this freed memory could be used.
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault.
Memory corruption when processing cmd parameters while parsing vdev.
Memory corruption while sending SMS from AP firmware.
Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.
Memory corruption while using the UIM diag command to get the operators name.
Memory corruption in Audio while processing RT proxy port register driver.
Memory corruption while receiving a message in Bus Socket Transport Server.
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
Memory corruption in DSP Service during a remote call from HLOS to DSP.
Memory corruption in Audio while running invalid audio recording from ADSP.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Memory corruption in Kernel while parsing metadata.
Memory corruption in Audio during playback with speaker protection.
Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.
In all Android releases from CAF using the Linux kernel, while processing a voice SVC request which is nonstandard by specifying a payload size that will overflow its own declared size, an out of bounds memory copy occurs.
Memory corruption due to use after free in Modem while modem initialization.
Memory corruption in Automotive Android OS due to improper input validation.
Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message.
Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.
Memory corruption in Linux android due to double free while calling unregister provider after register call.
Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host
Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.
Memory corruption due to double free in core while initializing the encryption key.