Use After Free in DSP Service

Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Integer Overflow or Wraparound in Display

Use After Free in Computer Vision

Use After Free in Computer Vision

Out-of-bounds Write in DSP Service

Buffer Copy Without Checking Size of Input in Automotive Platform

Out-of-bounds Write in Computer Vision

Buffer Over-read in Graphics

Memory corruption while processing MFC channel configuration during music playback

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers

Memory corruption while processing commands from A2dp sink command queue

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption while processing GPU page table switch

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while handling session errors from firmware

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption when the bandpass filter order received from AHAL is not within the expected range

Memory corruption while sending SMS from AP firmware

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption in Linux while sending DRM request

Memory corruption in Linux android due to double free while calling unregister provider after register call

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key

Memory corruption due to use after free in Modem while modem initialization

Information disclosure while creating MQ channels

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Transient DOS during music playback of ALAC content

Information disclosure while handling beacon or probe response frame in STA

Transient DOS in Modem while triggering a camping on an 5G cell

Transient DOS in Audio while remapping channel buffer in media codec decoding

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported

Use After Free in Computer Vision

Improper Validation of Syntactic Correctness of Input in Display

Stack-based Buffer Overflow in Display

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Cryptographic issue while performing RSA PKCS padding decoding

Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…