Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Buffer Copy Without Checking Size of Input in Powerline Communication Firmware

Stack-based Buffer Overflow in WLAN Firmware

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE

Use After Free in Computer Vision

Use After Free in Computer Vision

Out-of-bounds Write in DSP Service

Out-of-bounds Write in Computer Vision

Buffer Over-read in Graphics

Use of Uninitialized Variable in HLOS

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux

Memory corruption while processing data packets in diag received from Unix clients

Memory corruption while operating the mailbox in Automotive

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC

Memory corruption while reading the FW response from the shared queue

Memory corruption while acquire and update IOCTLs during IFE output resource ID validation

Memory corruption while prociesing command buffer buffer in OPE module

Memory corruption Camera kernel when large number of devices are attached through userspace

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption due to improper bounds check while command handling in camera-kernel driver

Memory corruption while encoding JPEG format

Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing camera use case IOCTL call

Memory corruption can occur in the camera when an invalid CID is used

Use After Free in Computer Vision

Memory corruption during GNSS HAL process initialization

Memory corruption while handling session errors from firmware

Memory corruption during session sign renewal request calls in HLOS

Memory corruption when the IOCTL call is interrupted by a signal

Buffer Over-read in WLAN Firmware

Transient DOS while parsing probe response and assoc response frame

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Use After Free in Computer Vision

Improper Validation of Syntactic Correctness of Input in Display

Reusing a Nonce, Key Pair in Encryption in HLOS

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Cryptographic Issues in Core