Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.
Memory corruption while processing memory map or unmap IOCTL operations simultaneously.
Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.
Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.
Memory corruption when programming registers through virtual CDM.
Memory corruption while processing message content in eAVB.
Memory corruption while processing camera TPG write request.
Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.
Memory corruption while processing escape code in API.
Memory corruption while calling the NPU driver APIs concurrently.
Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Memory corruption in DSP Service during a remote call from HLOS to DSP.
Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
Memory corruption while invoking callback function of AFE from ADSP.
Memory corruption in Audio while processing the VOC packet data from ADSP.
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
Memory corruption in Core while processing RX intent request.
Memory corruption in Audio while running invalid audio recording from ADSP.
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Memory corruption in Audio while processing RT proxy port register driver.
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Memory corruption while processing finish_sign command to pass a rsp buffer.
Memory corruption while using the UIM diag command to get the operators name.
Memory corruption in Automotive Display while destroying the image handle created using connected display driver.
Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
Memory corruption while parsing the ADSP response command.
Memory corruption while running VK synchronization with KASAN enabled.
Memory corruption in HLOS while converting from authorization token to HIDL vector.
Memory corruption in HLOS while invoking IOCTL calls from user-space.
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
Memory corruption in TZ Secure OS while loading an app ELF.
Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.
Memory corruption while allocating memory in COmxApeDec module in Audio.
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9205, MDM9640, MSM8996AU, QCA6574, QCS605, Qualcomm 215, SD 425, SD 427, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
Memory corruption in SPS Application while requesting for public key in sorter TA.