Memory corruption may occur while processing message from frontend during allocation

Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone

Information disclosure in Core services while processing a Diag command

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Out-of-bounds Write in Camera Driver

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

Memory corruption while handling the PDR in driver for getting the remote heap maps

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same

Memory corruption may occur while processing voice call registration with user

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while invoking IOCTL map buffer request from userspace

Reachable Assertion in FW

Reachable Assertion in Modem

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Buffer Over-read in Automotive Software platform based on QNX

Buffer Over-read in Core Services

Buffer Over-read in Video

Buffer Over-read in Audio

Information disclosure while opening a fastrpc session when domain is not sanitized

Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message

Buffer Over-read in Video

Buffer Over-read in Video

Information disclosure while processing a packet at EAVB BE side with invalid header length

Information disclosure while deriving keys for a session for any Widevine use case

Information disclosure while processing IO control commands

Information disclosure during audio playback

Buffer Over-read in Automotive Autonomy

Buffer Over-read in Audio

Buffer Over-read in Automotive Autonomy

Buffer Over-read in FM Host

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS while processing channel information for speaker protection v2 module in ADSP

Transient DOS in Audio when invoking callback function of ASM driver

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call