Memory corruption while reading CPU state data during guest VM suspend

Memory corruption can occur in the camera when an invalid CID is used

Integer Overflow to Buffer Overflow in Automotive OS Platform

Memory corruption during GNSS HAL process initialization

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while processing GPU commands

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing user packets to generate page faults

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Memory corruption when kernel driver attempts to trigger hardware fences

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when keymaster operation imports a shared key

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption while querying module parameters from Listen Sound model client in kernel from user space

Memory corruption while copying the sound model data from user to kernel buffer during sound model register

Memory corruption when the bandpass filter order received from AHAL is not within the expected range

Memory corruption when multiple listeners are being registered with the same file descriptor

Memory corruption in Automotive Multimedia due to improper access control in HAB

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory corruption in Automotive Display while destroying the image handle created using connected display driver

Information disclosure while creating MQ channels

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host

Transient DOS while parsing probe response and assoc response frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS during music playback of ALAC content

Information disclosure while handling beacon probe frame during scan entry generation in client side

Information disclosure while handling beacon or probe response frame in STA

Information disclosure while parsing sub-IE length during new IE generation

Improper Validation of Syntactic Correctness of Input in Display

Stack-based Buffer Overflow in Display

Reusing a Nonce, Key Pair in Encryption in HLOS

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Cryptographic Issues in Core

Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX

Memory corruption may occur in keyboard virtual device due to guest VM interaction

Memory corruption may occur while processing message from frontend during allocation

Out-of-bounds Write in Camera Driver

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record

Buffer Over-read in WLAN Firmware

Reachable Assertion in BT Controller

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Buffer Over-read in Video

Buffer Over-read in Automotive Software platform based on QNX