Stack-based Buffer Overflow in WLAN Firmware

Memory corruption while decoding of OTA messages from T3448 IE

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Information Disclosure while parsing beacon frame in STA

Integer Overflow or Wraparound in GPS

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Missing Authentication for Critical Function in Data Modem

Buffer Copy Without Checking Size of Input in Automotive Platform

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls

Memory corruption while processing a secure logging command in the trusted application

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption during GNSS HAL process initialization

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Use After Free in Qualcomm IPC

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Information disclosure while creating MQ channels

Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

Transient DOS while processing power control requests with invalid antenna or stream values

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem

Transient DOS while parsing probe response and assoc response frame

Buffer Over-read in Multi Mode Call Processor

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS during music playback of ALAC content

Information disclosure while handling beacon or probe response frame in STA

Improper Validation of Syntactic Correctness of Input in Display

Stack-based Buffer Overflow in Display

Cryptographic issue while performing RSA PKCS padding decoding

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption while processing the update SIM PB records request

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Information disclosure while processing a firmware event

Information disclosure while opening a fastrpc session when domain is not sanitized

Transient DOS while processing video packets received from video firmware