Use After Free in DSP Service

Use of Out-of-range Pointer Offset in Trust Management Engine

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while processing camera use case IOCTL call

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption in Camera due to unusually high number of nodes passed to AXI port

Memory corruption while validating number of devices in Camera kernel

Use After Free in Computer Vision

Use of Out-of-range Pointer Offset in Computer Vision

Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity

Memory corruption when invalid input is passed to invoke GPU Headroom API call

Memory corruption during GNSS HAL process initialization

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while processing GPU commands

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node

Memory corruption while handling session errors from firmware

Memory corruption while processing IOCTL calls to unmap the buffers

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision

Untrusted Pointer Dereference in Computer Vision

Memory corruption during session sign renewal request calls in HLOS

Memory corruption in Audio when SSR event is triggered after music playback is stopped

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range

Memory corruption due to improper validation of array index in Audio

Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions

Memory corruption due to use after free in Core when multiple DCI clients register and deregister

Memory corruption in graphics due to use-after-free while graphics profiling in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in kernel due to use after free issue in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Memory corruption in audio while playing record due to improper list handling in two threads in Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

Memory corruption in audio module due to integer overflow in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

Potential memory leak in modem during the processing of NSA RRC Reconfiguration with invalid Radio Bearer Config in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Out of bounds writing is possible while verifying device IDs due to improper length check before copying the data in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in audio due to use after free while managing buffers from internal cache in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile

Buffer Over-read in WLAN Firmware

Reachable Assertion in WLAN Firmware

Buffer Over-read in WLAN Host Communication

Buffer Over-read in Multi-Mode Call Processor

Buffer Over-read in WLAN Firmware

Transient DOS may occur while processing the country IE

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem

Transient DOS while parsing probe response and assoc response frame

Buffer Over-read in Multi Mode Call Processor

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon