Improper Validation of Array Index in Multi-Mode Call Processor

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Memory corruption due to improper validation of array index in Multi-mode call processor

Memory corruption in Hypervisor when platform information mentioned is not aligned

Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Buffer Over-read in Multi Mode Call Processor

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment

Possible access control violation while setting current permission for VMIDs due to improper permission masking in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Improper access control while doing XPU re-configuration dynamically can lead to unauthorized access to a secure resource in Snapdragon Compute, Snapdragon Connectivity,…

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Transient DOS while processing CCCH data when NW sends data with invalid length

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Transient DOS in Data modem while handling TLB control messages from the Network

Transient DOS in Modem when a Beam switch request is made with a non-configured BWP

Transient DOS in Modem after RRC Setup message is received

Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network

Transient DOS due to reachable assertion in Modem because of invalid network configuration

Assertion occurs while processing Reconfiguration message due to improper validation

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported

Transient DOS due to reachable assertion in Modem during OSI decode scheduling

Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH

Transient DOS in modem due to reachable assertion

Transient DOS due to reachable assertion in Modem while processing SIB1 Message

Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover

Transient DOS due to reachable assertion in modem during MIB reception and SIB timeout

Denial of service in Modem due to reachable assertion while processing the common config procedure in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon…

Missing Cryptographic Step in Data Modem

Information disclosure due to buffer over read in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Reachable Assertion in FW

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message

There may be information disclosure during memory re-allocation in TZ Secure OS

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation

Denial of service in MODEM due to improper pointer handling

Reading PRNG output may lead to improper key generation due to lack of buffer validation in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…