Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.

Memory corruption when IOCTL call is invoked from user-space to read board data.

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Memory corruption while processing IOCTL calls.

Memory corruption while processing API calls to NPU with invalid input.

Memory corruption when invalid input is passed to invoke GPU Headroom API call.

Buffer overwrite in the WLAN host driver by leveraging a compromised WLAN FW

Possible buffer overflow in voice service due to lack of input validation of parameters in QMI Voice API in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Memory corruption while maintaining memory maps of HLOS memory.

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.

Memory corruption while processing command in Glink linux.

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.

Out of bound write can occur in playready while processing command due to lack of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

u'Possible buffer overflow in WIFI hal process due to usage of memcpy without checking length of destination buffer' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile in QCM4290, QCS4290, QM215, QSM8350, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SC8180X, SC8180XP, SDX55, SDX55M, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6250, SM6350, SM7125, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P

Memory corruption while handling file descriptor during listener registration/de-registration.

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization.

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.

Memory corruption while processing camera use case IOCTL call.

User could gain access to secure memory due to incorrect argument into address range validation api used in SDI to capture requested contents in Snapdragon Industrial IOT, Snapdragon Mobile

Possible memory corruption in BSI module due to improper validation of parameter count in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile

Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables