Use After Free in DSP Service

Integer Overflow or Wraparound in Graphics Linux

Use of Out-of-range Pointer Offset in Graphics

Use After Free in DSP Services

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Memory corruption while loading an ELF segment in TEE Kernel

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Integer Overflow or Wraparound in Display

Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Buffer Over-read in Multi Mode Call Processor

An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Memory corruption while performing encryption and decryption commands

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption while retrieving the CBOR data from TA

Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses

Memory corruption during the FRS UDS generation process

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption during concurrent buffer access due to modification of the reference count

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption during concurrent access to server info object due to unprotected critical field

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption while configuring a Hypervisor based input virtual device

Memory corruption while processing API calls to NPU with invalid input

Memory corruption while Configuring the SMR/S2CR register in Bypass mode

Use After Free in DSP Service

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released

Memory corruption when an invoke call and a TEE call are bound for the same trusted application

Memory corruption while processing key blob passed by the user

Memory corruption while performing finish HMAC operation when context is freed by keymaster

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization

Memory corruption when the channel ID passed by user is not validated and further used

Memory corruption when the payload received from firmware is not as per the expected protocol size