Use After Free in HLOS

Memory corruption may occur while processing voice call registration with user

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan

Transient DOS during hypervisor virtual I/O operation in a virtual machine

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE

Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames

Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames

Information disclosure due to buffer over-read in WLAN while parsing BTM action frame

Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Information disclosure while processing message from client with invalid payload

information disclosure while invoking calibration data from user space to update firmware size

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Information Exposure in Computer Vision

Information disclosure while processing a packet at EAVB BE side with invalid header length

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus

There may be information disclosure during memory re-allocation in TZ Secure OS

Information disclosure while deriving keys for a session for any Widevine use case

Information disclosure while processing IO control commands

Information disclosure during audio playback

Information disclosure while processing information on firmware image during core initialization

Buffer Over-read in Automotive OS Platform

Buffer Over-read in Automotive Autonomy

Buffer Over-read in Audio

Buffer Over-read in Automotive Autonomy

Buffer Over-read in FM Host

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Transient DOS while loading the TA ELF file

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure while parsing dts header atom in Video

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call

Transient DOS in Automotive OS due to improper authentication to the secure IO calls

Information disclosure in WLAN HAL while handling command through WMI interfaces

Information disclosure in IOE Firmware while handling WMI command

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM

Information Disclosure in WLAN Host when processing WMI event command

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan

Information disclosure in Automotive multimedia due to buffer over-read

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request

Information disclosure in Kernel due to indirect branch misprediction

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation

Information Disclosure in Graphics during GPU context switch

Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file

Information disclosure due to buffer overread in Core