Improper Access Control in Camera Driver

Improper Access Control in Camera Driver

Out-of-bounds Write in Computer Vision

Out-of-bounds Write in Computer Vision

Improper Input Validation in HLOS

Detection of Error Condition Without Action in Hypervisor

Improper Validation of Array Index in Camera Driver

Improper Validation of Array Index in Camera Driver

Integer Overflow or Wraparound in Camera Driver

Use of Out-of-range Pointer Offset in Camera Driver

Buffer Over-read in Camera Driver

Use After Free in Camera Driver

Use After Free in HLOS

Out-of-bounds Write in Camera Driver

Memory corruption may occur while processing device IO control call for session control

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver

Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer

Memory corruption while IOCTL call is invoked from user-space to read board data

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call

Memory corruption while processing escape code in API

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption occurs during an Escape call if an invalid Kernel Mode CPU event and sync object handle are passed with the DriverKnownEscape flag reset

Memory corruption while doing Escape call when user provides valid kernel address in the place of valid user buffer address

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing camera use case IOCTL call

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality

Memory corruption can occur in the camera when an invalid CID is used

Memory corruption while validating number of devices in Camera kernel

Memory corruption may occour while generating test pattern due to negative indexing of display ID

Memory corruption while handling IOCTL call from user-space to set latency level

Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls

Improper Validation of Array Index in DSP Services

Buffer Over-read in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Buffer Over-read in WLAN Windows Host

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Use After Free in Computer Vision

Use After Free in Computer Vision

Use of Out-of-range Pointer Offset in Computer Vision

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information