Possible buffer overflow due to lack of length check of source and destination buffer before copying in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…

Out of Bounds write in Linux Camera

Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request

Memory corruption may occur while processing the OIS packet parser

Memory corruption while processing I2C settings in Camera driver

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware

Use After Free in Camera Driver

Reachable Assertion in FW

Buffer Over-read in WLAN Firmware

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Improper handling of resource allocation in virtual machines can lead to information exposure in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute,…

Memory corruption while processing a config call from userspace

A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile,…

Information disclosure while processing a firmware event

Information disclosure while processing batch command execution in Video driver

Information disclosure when Video engine escape input data is less than expected minimum size

Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message

Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Buffer Over-read in WLAN Host Communication

Buffer Over-read in DSP Service

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID

Transient DOS while parsing video packets received from the video firmware

Transient DOS while processing IOCTL call for image encoding

Transient DOS while processing video packets received from video firmware

Information disclosure while processing information on firmware image during core initialization

Information Disclosure while processing IOCTL request in FastRPC

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Information disclosure in Automotive multimedia due to buffer over-read

Information disclosure in DSP Services while loading dynamic module

Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message queue

Information disclosure in Trusted Execution Environment due to buffer over-read while processing metadata verification requests

Denial of service in MODEM due to improper pointer handling

Denial of service due to reachable assertion in modem while processing filter rule from application client in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile

Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,…

Possible buffer overflow due to lack of buffer length check during management frame Rx handling lead to denial of service in Snapdragon Compute, Snapdragon Connectivity,…

Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Improper validation of permissions for third party application accessing Telephony service API can lead to information disclosure in Snapdragon Compute, Snapdragon Connectivity,…

RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired…

RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired…

Reading PRNG output may lead to improper key generation due to lack of buffer validation in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…