Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Memory corruption in Hypervisor when platform information mentioned is not aligned

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Information disclosure may occur due to improper permission and access controls to Video Analytics engine

Use After Free in DSP Service

Use After Free in Computer Vision

Use After Free in Computer Vision

Out-of-bounds Write in DSP Service

Out-of-bounds Write in Computer Vision

Buffer Over-read in Graphics

Memory corruption while processing identity credential operations in the trusted application

Memory corruption during video playback when video session open fails with time out error

Memory corruption while submitting blob data to kernel space though IOCTL

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption while operating the mailbox in Automotive

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC

Memory corruption while reading the FW response from the shared queue

Memory corruption while acquire and update IOCTLs during IFE output resource ID validation

Memory corruption while prociesing command buffer buffer in OPE module

Memory corruption Camera kernel when large number of devices are attached through userspace

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption due to improper bounds check while command handling in camera-kernel driver

Memory corruption while encoding JPEG format

Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing camera use case IOCTL call

Memory corruption can occur in the camera when an invalid CID is used

Use After Free in Computer Vision

Memory corruption during GNSS HAL process initialization

Memory corruption while handling session errors from firmware

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when the IOCTL call is interrupted by a signal

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory corruption due to improper validation of array index in Audio

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Buffer Over-read in WLAN Firmware

Transient DOS while parsing probe response and assoc response frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon