Integer Overflow or Wraparound in Graphics

Integer Overflow or Wraparound in Graphics Linux

Use After Free in DSP Services

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Use After Free in Graphics

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer…

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Use After Free in DSP Service

Untrusted Pointer Dereference in Graphics

Missing Authorization in Core

Use After Free in Automotive GPU

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls

Memory corruption while handling different IOCTL calls from the user-space simultaneously

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors

Memory corruption while handling IOCTL calls to set mode

Memory corruption while copying packets received from unix clients

Memory corruption while processing MFC channel configuration during music playback

Memory corruption while processing a malformed license file during reboot

Memory corruption during PlayReady APP usecase while processing TA commands

Memory corruption while performing private key encryption in trusted application

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption while processing video packets received from video firmware

Memory corruption while calling the NPU driver APIs concurrently

Memory corruption may occur while validating ports and channels in Audio driver

Use After Free in DSP Service

Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released

Memory corruption when an invoke call and a TEE call are bound for the same trusted application

Memory corruption while processing key blob passed by the user

Memory corruption while performing finish HMAC operation when context is freed by keymaster

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked

Memory corruption when the payload received from firmware is not as per the expected protocol size

Memory corruption when there is failed unmap operation in GPU

Memory corruption while processing finish_sign command to pass a rsp buffer

Memory corruption in SPS Application while requesting for public key in sorter TA

Memory corruption in Audio while processing RT proxy port register driver

Memory corruption in Core Services while executing the command for removing a single event listener