Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.
Memory Corruption when processing fastboot commands to set display mode.
Memory corruption while processing fastboot commands with improperly formatted input.
Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.
Memory corruption while processing fastboot commands with invalid input.
Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.
Memory corruption while processing fastboot OEM commands.
Memory Corruption when processing display command line information due to improper initialization of a variable.
Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.
Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
Memory Corruption when copying data from a freed source while executing performance counter deselect operation.
Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level.
Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.
Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
Memory corruption while using alignments for memory allocation.
Memory Corruption when adding user-supplied data without checking available buffer space.
Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.
Memory corruption while handling different IOCTL calls from the user-space simultaneously.
Memory Corruption when accessing buffers with invalid length during TA invocation.
Transient DOS when an LTE RLC packet with invalid TB is received by UE.
Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.
Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.
Cryptographic issue while performing RSA PKCS padding decoding.
Transient DOS while processing an ANQP message.
Information disclosure while processing the hash segment in an MBN file.
Information disclosure while reading data from an image using specified offset and size parameters.
Transient DOS while processing received beacon frame.
Transient DOS may occur while processing malformed length field in SSID IEs.
There may be information disclosure during memory re-allocation in TZ Secure OS.
Information disclosure while deriving keys for a session for any Widevine use case.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
memory corruption when an invalid firehose patch command is invoked.
Cryptographic issue while parsing RSA keys in COBR format.
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
Memory corruption while processing key blob passed by the user.
Transient DOS while loading the TA ELF file.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
Memory corruption while processing finish_sign command to pass a rsp buffer.
Memory corruption in SPS Application while requesting for public key in sorter TA.
Memory corruption in Audio while processing RT proxy port register driver.
Memory corruption in Core Services while executing the command for removing a single event listener.
Transient DOS while parse fils IE with length equal to 1.
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.