Reusing a Nonce, Key Pair in Encryption in Automotive Platform

Double Free in Graphics

Buffer Copy Without Checking Size of Input in DSP Service

Buffer Copy without Checking Size of Input in DSP Service

Use After Free in HLOS

Memory corruption while allocating buffers in DSP service

Memory corruption due to global buffer overflow when a test command uses an invalid payload type

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency

Memory corruption during sub-system restart while processing clean-up to free up resources

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption during the FRS UDS generation process

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Transient DOS while processing power control requests with invalid antenna or stream values

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range

Transient DOS may occur while parsing SSID in action frames