Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call

Memory corruption during the network scan request

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file

Memory corruption may occur while processing the OIS packet parser

Memory corruption while processing I2C settings in Camera driver

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while invoking IOCTL map buffer request from userspace

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Information Exposure in Computer Vision