Assertion occurs while processing Reconfiguration message due to improper validation

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported

Transient DOS due to reachable assertion in Modem during OSI decode scheduling

Stack-based Buffer Overflow in Display

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Cryptographic issue while performing RSA PKCS padding decoding

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Out of Bounds write in Linux Camera

Memory corruption while processing I2C settings in Camera driver

Memory corruption while processing IOCTL command to handle buffers associated with a session

Memory corruption may occur while processing voice call registration with user

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Reachable Assertion in FW

Information disclosure while processing a firmware event

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID