Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Out of Bounds write in Linux Camera

Memory corruption while handling buffer mapping operations in the cryptographic driver

Memory corruption may occur while processing voice call registration with user

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

information disclosure while invoking calibration data from user space to update firmware size

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Information disclosure while deriving keys for a session for any Widevine use case

Information disclosure while processing IO control commands

Information disclosure during audio playback

Buffer Over-read in Audio

Transient DOS while loading the TA ELF file

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS in Audio when invoking callback function of ASM driver

Transient DOS in Automotive OS due to improper authentication to the secure IO calls

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM

information disclosure due to cryptographic issue in Core during RPMB read request