Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Incorrect handling of pointers in trusted application key import mechanism could cause memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in RPMB counter due to lack of length check on user provided data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Use after free in camera If the threadmanager is being cleaned up while the worker thread is processing objects in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Locked memory can be unlocked and modified by non secure boot loader through improper system call sequence making the memory region untrusted source of input for secure boot…

User could gain access to secure memory due to incorrect argument into address range validation api used in SDI to capture requested contents in Snapdragon Industrial IOT,…

Part of RPM region was not protected from xblSec itself due to improper policy and leads to unprivileged access in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Buffer Over-read in WLAN Firmware

Buffer Over-read in BT Controller

Transient DOS while creating NDP instance

Transient DOS while processing a frame with malformed shared-key descriptor

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests

Transient DOS while processing the EHT operation IE in the received beacon frame

Transient DOS while parsing per STA profile in ML IE

Transient DOS may occur while parsing extended IE in beacon

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP

Information disclosure while parsing the OCI IE with invalid length

Buffer Over-read in WLAN Host Cmn

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length

Transient DOS while processing TID-to-link mapping IE elements

Transient DOS while parsing the received TID-to-link mapping action frame

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report

Information disclosure while parsing sub-IE length during new IE generation

Information disclosure while handling SA query action frame

INformation disclosure while handling Multi-link IE in beacon frame

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame

Information disclosure while handling T2LM Action Frame in WLAN Host

Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame

Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame

Transient DOS while processing 11AZ RTT management action frame received through OTA

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element

Transient DOS in WLAN Firmware while processing a FTMR frame

Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids

Transient DOS in Bluetooth Host while rfc slot allocation

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE

Transient DOS in WLAN Firmware while parsing t2lm buffers

Transient DOS in WLAN Firmware while parsing no-inherit IES