Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments

Memory corruption in MPP performance while accessing DSM watermark using external memory address

Memory Corruption in SPS Application while exporting public key in sorter TA

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory corruption in Audio while processing the VOC packet data from ADSP

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer

Cryptographic issue in HLOS during key management

Memory Corruption in Core due to secure memory access by user while loading modem image

The cam_get_device_priv function does not check the type of handle being returned (device/session/link)

Memory Corruption in WLAN HOST while fetching TX status information

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption

Memory corruption due to improper access control in kernel while processing a mapping request from root process

Memory corruption due to double free in Core while mapping HLOS address to the list

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message

Memory corruption in Graphics while importing a file

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length

Memory corruption due to double free in core while initializing the encryption key

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command

Transient DOS while decoding the ToBeSignedMessage in Automotive Telematics

Transient DOS while decoding message of size that exceeds the available system memory

Transient DOS while decoding an ASN.1 OER message containing a SEQUENCE of unknown extensions

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value

Transient DOS in Modem while allocating DSM items

Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE

Transient DOS due to improper authorization in Modem

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Improper Validation of Syntactic Correctness of Input in Display

Missing Cryptographic Step in Data Modem

Cryptographic Issues in Core

Information disclosure in Audio while accessing AVCS services from ADSP payload

Memory corruption while parsing the memory map info in IOCTL calls

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Out of Bounds write in Linux Camera

Use After Free in HLOS

Memory corruption may occur while processing voice call registration with user

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Buffer Over-read in Audio

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware