Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call

Memory corruption during the network scan request

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same

Memory corruption may occur while processing the OIS packet parser

Memory corruption while processing I2C settings in Camera driver

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while invoking IOCTL map buffer request from userspace

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation

Buffer Over-read in Video

information disclosure while invoking calibration data from user space to update firmware size

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Information Exposure in Computer Vision

Buffer Over-read in Video

Transient DOS while processing video packets received from video firmware

Information disclosure while processing IO control commands

Information disclosure while processing information on firmware image during core initialization

Buffer Over-read in DSP Service

Information disclosure while parsing dts header atom in Video

Information disclosure in Automotive multimedia due to buffer over-read

Information disclosure in DSP Services while loading dynamic module

Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,…

Information disclosure in video due to buffer over-read while processing avi file in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…

Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired…

RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired…

Reading PRNG output may lead to improper key generation due to lack of buffer validation in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Possible buffer overflow due to improper data validation of external commands sent via DIAG interface in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Denial of service in BOOT when partition size for a particular partition is requested due to integer overflow when blocks are calculated in Snapdragon Auto, Snapdragon Compute,…