Memory corruption may occur while processing voice call registration with user.
Memory corruption while processing I2C settings in Camera driver.
Memory corruption may occur while processing the OIS packet parser.
Memory corruption while processing IOCTL command to handle buffers associated with a session.
Memory corruption while accessing MSM channel map and mixer functions.
Memory corruption while processing IOCTL calls to add route entry in the HW.
Memory corruption while invoking IOCTL map buffer request from userspace.
Memory corruption while handling buffer mapping operations in the cryptographic driver.
Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.
Memory corruption while processing frame packets.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.
Memory corruption while processing camera TPG write request.
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
Memory corruption while performing SCM call.
Memory corruption in modem due to use of out of range pointer offset while processing qmi msg
Memory corruption in Audio while running invalid audio recording from ADSP.
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
Memory corruption in Audio during playback with speaker protection.
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
Memory corruption in Modem while processing security related configuration before AS Security Exchange.
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Memory corruption in Audio while processing RT proxy port register driver.
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality.
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
Memory corruption may occour while generating test pattern due to negative indexing of display ID.
Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.
Memory corruption may occur during IO configuration processing when the IO port count is invalid.
Memory corruption while processing an escape call.
Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.
Memory corruption when malformed message payload is received from firmware.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory Corruption in Multi-mode Call Processor while processing bit mask API.