Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Memory corruption in Hypervisor when platform information mentioned is not aligned

Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT

Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in Snapdragon Connectivity, Snapdragon…

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network

Buffer Over-read in Multi Mode Call Processor

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Use After Free in Graphics

Use After Free in Automotive Audio

Out-of-bounds Write in Display

Buffer Copy Without Checking Size of Input in HLOS

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption while reading secure file

Memory corruption while calling the NPU driver APIs concurrently

Memory corruption in display driver while detaching a device

Memory corruption may occur while validating ports and channels in Audio driver

Memory corruption while power-up or power-down sequence of the camera sensor

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Memory Corruption in Core during syscall for Sectools Fuse comparison feature

Memory corruption while parsing the ADSP response command

Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal

Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon…

Memory corruption in kernel due to use after free issue in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Devices with keyprotect off may store unencrypted keybox in RPMB and cause cryptographic issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Memory corruption due to out of bound read while parsing a video file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Use after free in graphics fence due to a race condition while closing fence file descriptor and destroy graphics timeline simultaneously in Snapdragon Auto, Snapdragon Compute,…

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Memory corruption in DSP service due to improper validation of input parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT,…

Improper verification of timeout-based authentication in identity credential can lead to invalid authorization in HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible hypervisor memory corruption due to TOC TOU race condition when updating address mappings in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon…

Possible heap overflow due to lack of index validation before allocating and writing to heap buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible out of bound read due to lack of domain input validation while processing APK close session request in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible access control violation while setting current permission for VMIDs due to improper permission masking in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Improper access control while doing XPU re-configuration dynamically can lead to unauthorized access to a secure resource in Snapdragon Compute, Snapdragon Connectivity,…

Possible integer overflow in RPMB counter due to lack of length check on user provided data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Transient DOS while processing CCCH data when NW sends data with invalid length

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Transient DOS while processing received beacon frame

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Information disclosure in Video while parsing mp2 clip with invalid section length

Transient DOS while processing DL NAS TRANSPORT message with payload length 0

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR

Transient DOS while processing PDU Release command with a parameter PDU ID out of range

Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16

Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR