Missing Authentication for Critical Function in Boot

Use After Free in DSP Service

Untrusted Pointer Dereference in Graphics

Use After Free in Graphics

Integer Overflow or Wraparound in Data Network Stack & Connectivity

NULL Pointer Dereference in HLOS

Use After Free in Automotive GPU

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory corruption while processing a frame request from user

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation

Memory Corruption when adding user-supplied data without checking available buffer space

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs

Memory Corruption when accessing trusted execution environment without proper privilege check

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls

Memory Corruption when accessing buffers with invalid length during TA invocation

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Buffer Over-read in WLAN HAL

Improper Validation of Syntactic Correctness of Input in Display

Improper Validation of Syntactic Correctness of Input in Display

Reusing a Nonce, Key Pair in Encryption in HLOS

Missing Authentication for Critical Function in HLOS

Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Transient DOS when processing a received frame with an excessively large authentication information element

Buffer Over-read in WLAN Host Communication

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver