Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Use After Free in Graphics

Memory corruption while selecting the PLMN from SOR failed list

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input

Memory corruption while processing a secure logging command in the trusted application

Memory corruption while copying packets received from unix clients

Memory corruption while processing a malformed license file during reboot

Memory corruption due to global buffer overflow when a test command uses an invalid payload type

Memory corruption while performing private key encryption in trusted application

Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake

Memory corruption when programming registers through virtual CDM

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware

Memory corruption while processing manipulated payload in video firmware

Memory corruption while triggering commands in the PlayReady Trusted application

Memory corruption while reading secure file

Memory corruption while calling the NPU driver APIs concurrently

Memory corruption in display driver while detaching a device

Memory corruption may occur while validating ports and channels in Audio driver

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption while power-up or power-down sequence of the camera sensor

Memory corruption can occur in the camera when an invalid CID is used

Memory corruption while validating number of devices in Camera kernel

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Transient DOS while processing received beacon frame

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range

Transient DOS may occur while parsing EHT operation IE or EHT capability IE

Memory corruption while accessing a synchronization object during concurrent operations

Memory corruption while parsing clock configuration data for a specific hardware type

Memory corruption while processing shared command buffer packet between camera userspace and kernel

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption while handling buffer mapping operations in the cryptographic driver

Memory corruption while processing IOCTL command to handle buffers associated with a session

Memory corruption while handling sensor utility operations

Memory corruption while processing a config call from userspace

Information disclosure while running video usecase having rogue firmware

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus

There may be information disclosure during memory re-allocation in TZ Secure OS