Use After Free in DSP Services

Memory corruption while redirecting log file to any file location with any file name

Memory corruption in WLAN Host while processing RRM beacon on the AP

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE

Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length

Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames

An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Compute, Snapdragon…

A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile,…

Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible buffer over read due to lack of length check while parsing beacon IE response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Buffer over-read can happen while processing WPA,RSN IE of beacon and response frames if IE length is less than length of frame pointer being accessed in Snapdragon Auto,…

Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer over read while processing P2P IE and NOA attribute of beacon and probe response frames due to improper validation of P2P IE and NOA attribute lengths in…

Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking

Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking

Memory corruption due to lack of validation of pointer arguments passed to TrustZone BSP in Snapdragon Wired Infrastructure and Networking

Memory corruption due to lack of check of validation of pointer to buffer passed to trustzone in Snapdragon Wired Infrastructure and Networking

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Missing Authentication for Critical Function in Boot

Use After Free in HLOS

Memory corruption when allocating and accessing an entry in an SMEM partition

Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command

Memory corruption in WLAN HAL while handling command through WMI interfaces

Memory corruption in WLAN HAL while handling command streams through WMI interfaces

Memory corruption in WLAN HAL while passing command parameters through WMI interfaces

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload

Memory corruption in WLAN handler while processing PhyID in Tx status handler

Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload

Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload

Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers

Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target

Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message

Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command

Memory corruption due to improper access control in Qualcomm IPC

Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Improper validation of data length received from DMA buffer can lead to memory corruption

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible assertion in QOS request due to improper validation when multiple add or update request are received simultaneously in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configuration command is received in Snapdragon…