Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Use After Free in DSP Service

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Integer Overflow or Wraparound in GPS

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Integer Overflow or Wraparound in Display

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Information disclosure may occur while processing goodbye RTCP packet from network

Missing Authentication for Critical Function in Data Modem

Missing Authorization in Core

NULL Pointer Dereference in SPS Applications

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption while processing API calls to NPU with invalid input

Memory corruption while processing GPU page table switch

Memory corruption while handling session errors from firmware

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory corruption while processing audio effects

Information disclosure while creating MQ channels

Insecure Security Identifier Mechanism in Multi-Mode Call Processor

Transient DOS while processing CCCH data when NW sends data with invalid length

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS during music playback of ALAC content

Information disclosure while handling beacon probe frame during scan entry generation in client side

Information disclosure while handling beacon or probe response frame in STA

Transient DOS in Modem while triggering a camping on an 5G cell

Improper Verification of Cryptographic Signature in Boot

Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race…