Integer Overflow or Wraparound in Graphics

Integer Overflow or Wraparound in Graphics Linux

Use of Out-of-range Pointer Offset in Graphics

Use After Free in DSP Services

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE

Memory corruption in WLAN Host while processing RRM beacon on the AP

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Missing Authorization in Core

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls

Memory corruption while handling IOCTL calls to set mode

Memory corruption while processing MFC channel configuration during music playback

Memory corruption during video playback when video session open fails with time out error

Memory corruption during PlayReady APP usecase while processing TA commands

Memory corruption while performing private key encryption in trusted application

Memory corruption while power-up or power-down sequence of the camera sensor

Memory corruption when allocating and accessing an entry in an SMEM partition continuously

Memory corruption while Configuring the SMR/S2CR register in Bypass mode

Use After Free in DSP Services

Use After Free in DSP Service

Return of Stack Variable Address in Buses

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released

Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events

Memory corruption while allocating memory in HGSL driver

Memory corruption while processing IOCTL call to set metainfo

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption while handling user packets during VBO bind operation

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size

Memory corruption when allocating and accessing an entry in an SMEM partition

Memory corruption when an invoke call and a TEE call are bound for the same trusted application

Memory corruption while processing key blob passed by the user

Memory corruption while performing finish HMAC operation when context is freed by keymaster

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of…

Memory corruption in Core while processing control functions

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP

Memory corruption in Audio when memory map command is executed consecutively in ADSP

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments

Memory corruption while running VK synchronization with KASAN enabled

Memory corruption in wearables while processing data from AON