Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Stack-based Buffer Overflow in Windows Compute

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Out of Bounds write in Linux Camera

Memory corruption while processing I2C settings in Camera driver

Memory corruption may occur while processing voice call registration with user

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Information disclosure while processing a firmware event

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID

Information disclosure during audio playback

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver