Memory corruption while handling sensor utility operations.
Memory corruption in Multimedia Framework due to unsafe access to the data members
Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues.
While processing storage SCM commands there is a time of check or time of use window where a pointer used could be invalid at a specific time while executing the storage SCM call in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
Certain unprivileged processes are able to perform IOCTL calls.
Memory corruption while receiving a message in Bus Socket Transport Server.
Memory corruption in Audio while processing IIR config data from AFE calibration block.
Memory corruption in HLOS while converting from authorization token to HIDL vector.
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
Memory corruption while sending SMS from AP firmware.
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validating the input, while handling a SetGatewayUrl() request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAP_CLI can be run via sudo or setuid, this also allows elevating privileges to root. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers.
Memory Corruption in camera while installing a fd for a particular DMA buffer.
Memory corruption in WLAN while running doDriverCmd for an unspecific command.
Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
Memory corruption in Trusted Execution Environment while calling service API with invalid address.
Memory corruption in Linux while calling system configuration APIs.
Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.
Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.
Memory corruption while handling the PDR in driver for getting the remote heap maps.
Memory corruption while processing IOCTL calls to unmap the buffers.
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
Memory corruption while processing frame command IOCTL calls.
Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.
Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.
Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.
Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
Memory corruption while processing the update SIM PB records request.
Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggered and callback instance is deleted in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Memory corruption due to use after free in trusted application environment.
Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries.
Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.
Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications.
Memory corruption due to use after free in Core when multiple DCI clients register and deregister.
Memory corruption in WLAN due to use after free
Memory corruption in Linux android due to double free while calling unregister provider after register call.
Memory corruption in Linux while sending DRM request.
Memory corruption in Audio due to incorrect type cast during audio use-cases.
Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host
Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.
Memory corruption due to use after free in Modem while modem initialization.
Improper validation of session id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Improper handling between export and release functions on the same handle from client can lead to use after free in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
An array index is improperly used to lock and unlock a mutex which can lead to a Use After Free condition In the Synx driver in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
An out-of-bounds write can occur due to an incorrect input check in the camera driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Use after free in the synx driver issue while performing other functions during multiple invocation of synx release calls in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile