Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Integer Overflow or Wraparound in GPS

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Missing Authentication for Critical Function in Data Modem

NULL Pointer Dereference in SPS Applications

Memory corruption while processing API calls to NPU with invalid input

Memory corruption while processing GPU page table switch

Memory corruption while handling session errors from firmware

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory corruption while processing audio effects

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race…

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Reachable Assertion in FW

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data