Memory corruption due to improper bounds check while command handling in camera-kernel driver.
Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call.
Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations.
Memory corruption while encoding JPEG format.
Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
Memory corruption while handling IOCTL call from user-space to set latency level.
Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.
Memory corruption may occour while generating test pattern due to negative indexing of display ID.
Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.
Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.
Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requirement check.
Memory corruption during concurrent access to server info object due to incorrect reference count update.
Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality.
Memory corruption during concurrent access to server info object due to unprotected critical field.
Memory corruption may occur during IO configuration processing when the IO port count is invalid.
Memory corruption Camera kernel when large number of devices are attached through userspace.
Memory corruption during concurrent SSR execution due to race condition on the global maps list.
Memory corruption when blob structure is modified by user-space after kernel verification.
Incorrect handling of pointers in trusted application key import mechanism could cause memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
Improper access control in TrustZone due to improper error handling while handling the signing key in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Memory corruption while sound model registration for voice activation with audio kernel driver.
A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
When a fake broadcast/multicast 11w rmf without mmie received, since no proper length check in wma_process_bip, buffer overflow will happen in both cds_is_mmie_valid and qdf_nbuf_trim_tail in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8937, MSM8996AU, MSM8998, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS605, SDM630, SDM636, SDM660, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130
An image with a version lower than the fuse version may potentially be booted lead to improper authentication.
Memory corruption during concurrent buffer access due to modification of the reference count.
Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.
Improper length check of public exponent in RSA import key function could cause memory corruption. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables
Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Wired Infrastructure and Networking
Possible double free issue in WLAN due to lack of checking memory free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, MDM9640, SDA660, SDM636, SDM660, SDX20
Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Crafted Binder Request Causes Heap UAF in MediaServer
Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Memory Corruption when multiple threads simultaneously access a memory free API.
Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
Memory corruption while processing an escape call.
Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.
Memory corruption when calculating oversized partition sizes without proper checks.
Memory corruption while preprocessing IOCTLs in sensors.
Memory corruption while invoking remote procedure IOCTL calls.
Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level.
Memory corruption while processing request sent from GVM.
Memory corruption when another driver calls an IOCTL with invalid input/output buffer.
Memory corruption while processing control commands in the virtual memory management interface.
Memory corruption while calculating offset from partition start point.
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.
Memory corruption while passing pages to DSP with an unaligned starting address.
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.