Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Improper access control sequence for AC database after memory allocation can lead to possible memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Memory corruption may occur while processing voice call registration with user

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Information disclosure while processing the hash segment in an MBN file

Information disclosure while reading data from an image using specified offset and size parameters

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation

Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device

Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Buffer Over-read in Core Services

Buffer Over-read in Audio

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Untrusted Pointer Dereference in TZ Firmware

Information disclosure while deriving keys for a session for any Widevine use case

Information disclosure while processing IO control commands

Information disclosure during audio playback

Buffer Over-read in Audio

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size

Information disclosure while parsing dts header atom in Video

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command

Transient DOS in Audio when invoking callback function of ASM driver

Transient DOS in Automotive OS due to improper authentication to the secure IO calls

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan

Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis

Information disclosure due to buffer overread in Core

Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…