Stack-based Buffer Overflow in WLAN Host

Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking

Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking

Memory corruption due to lack of validation of pointer arguments passed to TrustZone BSP in Snapdragon Wired Infrastructure and Networking

Memory corruption due to lack of check of validation of pointer to buffer passed to trustzone in Snapdragon Wired Infrastructure and Networking

Incorrect Calculation of Buffer Size in SCE-Mink

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface

Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image

Memory corruption while processing TPC target power table in FTM TPC

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of…

Memory corruption in Core while processing control functions

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region

Memory corruption in Kernel while parsing metadata

Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message

Memory Corruption in WLAN HOST while parsing QMI response message from firmware

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory

Memory corruption in Linux Networking due to double free while handling a hyp-assign

Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase

Memory corruption due to improper access control in Qualcomm IPC

Memory corruption in core due to stack-based buffer overflow

Memory corruption in Core due to stack-based buffer overflow

Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command

Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Cryptographic issues in BSP due to improper hash verification in Snapdragon Wired Infrastructure and Networking

Possible unauthorized access to secure space due to improper check of data allowed while flashing the no access control device configuration in Snapdragon Auto, Snapdragon…

Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Improper cleaning of secure memory between authenticated users can lead to face authentication bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible assertion in QOS request due to improper validation when multiple add or update request are received simultaneously in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible out of bound write in RAM partition table due to improper validation on number of partitions provided in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in page alignment interface due to lack of address and size validation before alignment in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in access control initialization interface due to lack and size and address validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN HAL

Buffer Over-read in WLAN HAL

Reachable Assertion in WLAN Firmware

Buffer Over-read in WLAN Firmware

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range

Transient DOS while processing the EHT operation IE in the received beacon frame

Transient DOS may occur while parsing extended IE in beacon

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present

Buffer Over-read in WLAN Firmware

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp

Transient DOS while parsing the received TID-to-link mapping action frame

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report

Information disclosure while parsing sub-IE length during new IE generation

Information disclosure while handling SA query action frame

INformation disclosure while handling Multi-link IE in beacon frame