Integer Overflow or Wraparound in Graphics

Use After Free in DSP Service

Integer Overflow or Wraparound in GPS

Integer Overflow or Wraparound in Display

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet

Information disclosure may occur while processing goodbye RTCP packet from network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Missing Authentication for Critical Function in Data Modem

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Use After Free in DSP Service

NULL Pointer Dereference in SPS Applications

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

Memory corruption while processing commands from A2dp sink command queue

Memory corruption when programming registers through virtual CDM

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption may occur while attaching VM when the HLOS retains access to VM

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while processing IOCTL calls

Memory corruption during GNSS HAL process initialization

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption while processing user packets to generate page faults

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Untrusted Pointer Dereference in Computer Vision

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption when keymaster operation imports a shared key

Memory corruption when malformed message payload is received from firmware

Memory corruption in HLOS while converting from authorization token to HIDL vector

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length

Information disclosure while creating MQ channels

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Transient DOS while processing CCCH data when NW sends data with invalid length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS during music playback of ALAC content

Transient DOS in Modem while triggering a camping on an 5G cell

Memory corruption when using Virtual cdm (Camera Data Mover) to write registers

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race…