Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver

Memory corruption while handling IOCTL calls in JPEG Encoder driver

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it

memory corruption in Kernel due to race condition while getting mapping reference in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Memory corruption or temporary denial of service due to improper handling of concurrent hypervisor operations to attach or detach IRQs from virtual interrupt sources in Snapdragon…

Possible memory corruption due to Improper handling of hypervisor unmap operations for concurrent memory operations in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, Snapdragon Connectivity, Snapdragon…

Information disclosure in Core services while processing a Diag command

Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible address manipulation from APP-NS while APP-S is configuring an RG where it tries to merge the address ranges in Snapdragon Connectivity, Snapdragon Mobile

Improper checking of AP-S lock bit while verifying the secure resource group permissions can lead to non secure read and write access in Snapdragon Connectivity, Snapdragon Mobile

Use After Free in Windows WLAN Host

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Stack-based Buffer Overflow in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Out-of-bounds Write in Core Services

Memory corruption while accessing a synchronization object during concurrent operations

Memory corruption while parsing clock configuration data for a specific hardware type

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Possible out of bound access in audio module due to lack of validation of user provided input

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Use after free in the synx driver issue while performing other functions during multiple invocation of synx release calls in Snapdragon Connectivity, Snapdragon Industrial IOT,…

An array index is improperly used to lock and unlock a mutex which can lead to a Use After Free condition In the Synx driver in Snapdragon Compute, Snapdragon Connectivity,…

Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible buffer overflow due to lack of length check of source and destination buffer before copying in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…

Out of Bounds write in Linux Camera

Memory corruption may occur while processing voice call registration with user

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Reachable Assertion in FW

Transient DOS when processing a received frame with an excessively large authentication information element

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation

Improper handling of resource allocation in virtual machines can lead to information exposure in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute,…

Memory corruption while handling sensor utility operations

Memory corruption while processing a config call from userspace

A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile,…

Information disclosure while processing a firmware event

Information disclosure when Video engine escape input data is less than expected minimum size

information disclosure while invoking calibration data from user space to update firmware size