Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Kernel

Improper Validation of Syntactic Correctness of Input in Kernel

Missing Cryptographic Step in Data Modem

Reusing a Nonce, Key Pair in Encryption in HLOS

Missing Authentication for Critical Function in HLOS

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Cryptographic issues while generating an asymmetric key pair for RKP use cases

Improper Input Validation in Trusted Execution Environment

Information disclosure in Audio while accessing AVCS services from ADSP payload

Buffer Over-read in Qualcomm IPC

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Memory corruption while processing simultaneous requests via escape path

Memory corruption when using Virtual cdm (Camera Data Mover) to write registers

Memory corruption during concurrent SSR execution due to race condition on the global maps list

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer

Memory corruption while parsing the memory map info in IOCTL calls

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Information disclosure in Core services while processing a Diag command

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Use After Free in Windows WLAN Host

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Out-of-bounds Write in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Out-of-bounds Write in Core Services

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

memory corruption when WiFi display APIs are invoked with large random inputs

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario