Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Integer Overflow or Wraparound in Graphics

Memory corruption while selecting the PLMN from SOR failed list

Memory corruption in Modem while processing security related configuration before AS Security Exchange

Integer Overflow or Wraparound in Display

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Buffer Over-read in Multi Mode Call Processor

Use After Free in DSP Service

Use After Free in Graphics

Memory Corruption when accessing trusted execution environment without proper privilege check

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources

Memory corruption while loading an invalid firmware in boot loader

Memory corruption while performing private key encryption in trusted application

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while processing GPU commands

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time

Memory corruption when kernel driver attempts to trigger hardware fences

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption when keymaster operation imports a shared key

Memory corruption while handling user packets during VBO bind operation

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Buffer Over-read in WLAN Firmware

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Transient DOS while processing an ANQP message

Transient DOS while processing CCCH data when NW sends data with invalid length

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Missing Authentication for Critical Function in HLOS

Out-of-bounds Write in Camera Driver

Memory corruption while processing shared command buffer packet between camera userspace and kernel

Memory corruption while processing IOCTL command to handle buffers associated with a session

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Transient DOS when MAC configures config id greater than supported maximum value