Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine

Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Buffer Copy Without Checking Size of Input in Boot

Integer Overflow or Wraparound in Display

Use After Free in SCE-Mink

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Weak configuration in Automotive while VM is processing a listener request from TEE

Exposed Dangerous Method or Function in HLOS

Integer Overflow or Wraparound in Automotive

Integer Overflow or Wraparound in Automotive

Improper Validation of Array Index in Automotive Linux OS

Use of Uninitialized Variable in HLOS

Out-of-bounds Write in HLOS

Buffer Copy Without Checking Size of Input in Core Services

Memory corruption while processing large input data from a remote source via a communication interface

Memory corruption when triggering a subsystem crash with an out-of-range identifier

Memory corruption while processing client message during device management

Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions

Memory corruption while processing request sent from GVM

Memory corruption while performing encryption and decryption commands

Memory corruption while processing control commands in the virtual memory management interface

Memory corruption while handling repeated memory unmap requests from guest VM

Memory corruption while processing data sent by FE driver

Memory corruption while processing message in guest VM

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency

Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host

Memory corruption while copying the result to the transmission queue in EMAC

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption while reading secure file

Memory corruption while processing message content in eAVB

Memory corruption while transmitting packet mapping information with invalid header payload size

Memory corruption while processing memory map or unmap IOCTL operations simultaneously

Memory corruption may occur due top improper access control in HAB process

Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine

Memory corruption while processing input message passed from FE driver

Memory corruption in display driver while detaching a device

Memory corruption may occur while accessing a variable during extended back to back tests

Memory corruption may occur during communication between primary and guest VM

Memory corruption may occur due to improper input validation in clock device

Memory corruption while reading CPU state data during guest VM suspend

Memory corruption while power-up or power-down sequence of the camera sensor

Memory corruption can occur in the camera when an invalid CID is used

Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace

Integer Overflow to Buffer Overflow in Automotive OS Platform