Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

Memory corruption in modem due to buffer overflow while processing a PPP packet

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device lock in Snapdragon Auto, Snapdragon Compute,…

Buffer Over-read in Multi Mode Call Processor

Memory corruption during PlayReady APP usecase while processing TA commands

Memory corruption while processing API calls to NPU with invalid input

QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory

Memory corruption while performing finish HMAC operation when context is freed by keymaster

Memory corruption while processing finish_sign command to pass a rsp buffer

Memory corruption in SPS Application while requesting for public key in sorter TA

Memory corruption in Audio while processing RT proxy port register driver

Memory corruption in Audio during playback with speaker protection

Memory corruption in HLOS while running playready use-case

Memory corruption while using the UIM diag command to get the operators name

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments

Memory corruption in MPP performance while accessing DSM watermark using external memory address

Memory Corruption in SPS Application while exporting public key in sorter TA

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length

Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM

Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http

Memory corruption due to configuration weakness in modem wile sending command to write protected files

Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible buffer overflow due to improper validation of array index while processing external DIAG command in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…

Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

A FTM Diag command can allow an arbitrary write into modem OS space in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…

Possible memory corruption due to lack of bound check of input index in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from HLOS in Snapdragon Auto, Snapdragon Consumer…

Buffer overflow occurs in trusted applications due to lack of length check of parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Improper length check of public exponent in RSA import key function could cause memory corruption

Possible buffer overflow due to lack of length check in Trusted Application in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Incorrect handling of pointers in trusted application key import mechanism could cause memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible buffer overflow in voice service due to lack of input validation of parameters in QMI Voice API in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Use after free issue when importing a DMA buffer by using the CPU address of the buffer due to attachment is not cleaned up properly in Snapdragon Auto, Snapdragon Compute,…

Out of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

A double free condition can occur when the device moves to suspend mode during secure playback in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters that are read from shared MSG RAM in…

Buffer Over-read in Multi Mode Call Processor

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command

Information Disclosure in data Modem while parsing an FMTP line in an SDP message

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value

Information disclosure in Network Services due to buffer over-read while the device receives DNS response

Transient DOS due to improper authorization in Modem