Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile

Possible assertion due to improper validation of symbols configured for PDCCH monitoring in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial…

Possible denial of service scenario due to improper input validation of received NAS OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Improper Input Validation in Trusted Execution Environment

Use After Free in DSP Service

Memory corruption while parsing the memory map info in IOCTL calls

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it

Possible memory corruption due to Improper handling of hypervisor unmap operations for concurrent memory operations in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Possible out of bound access in audio module due to lack of validation of user provided input

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call

Memory corruption during the network scan request

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same

Memory corruption in kernel due to improper input validation while processing ION commands in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…

Possible buffer overflow due to lack of length check of source and destination buffer before copying in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…

Out of Bounds write in Linux Camera

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Buffer Copy Without Checking Size of Input in Audio

Memory corruption while processing IOCTL calls to add route entry in the HW

Memory corruption while accessing MSM channel map and mixer functions

Integer Underflow (Wrap or Wraparound) in WLAN Host

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation

Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute,…

A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile,…

Buffer Over-read in Audio

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Information Exposure in Computer Vision

Buffer Over-read in Video

Buffer Over-read in Video

Information disclosure while processing IO control commands

Information disclosure while processing information on firmware image during core initialization

Buffer Over-read in DSP Service

Information disclosure while parsing dts header atom in Video

Information disclosure in Automotive multimedia due to buffer over-read

Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,…

Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables