Information disclosure in Core services while processing a Diag command

Possible address manipulation from APP-NS while APP-S is configuring an RG where it tries to merge the address ranges in Snapdragon Connectivity, Snapdragon Mobile

Improper checking of AP-S lock bit while verifying the secure resource group permissions can lead to non secure read and write access in Snapdragon Connectivity, Snapdragon Mobile

Use After Free in Windows WLAN Host

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Stack-based Buffer Overflow in Windows Compute

Stack-based Buffer Overflow in Windows Compute

Out-of-bounds Write in Core Services

Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Memory corruption when multiple threads try to unregister the CVP buffer at the same time

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or…

Possible out of bound access in audio module due to lack of validation of user provided input

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

memory corruption when WiFi display APIs are invoked with large random inputs

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario

Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call

Memory corruption during the network scan request

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same

Use after free in the synx driver issue while performing other functions during multiple invocation of synx release calls in Snapdragon Connectivity, Snapdragon Industrial IOT,…

An array index is improperly used to lock and unlock a mutex which can lead to a Use After Free condition In the Synx driver in Snapdragon Compute, Snapdragon Connectivity,…

Out of Bounds write in Linux Camera

Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request

Memory corruption may occur while processing the OIS packet parser

Memory corruption while processing I2C settings in Camera driver

Memory corruption while processing IOCTL calls to add route entry in the HW

Integer Underflow (Wrap or Wraparound) in WLAN Host

Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware

Use After Free in Camera Driver

Reachable Assertion in FW

Buffer Over-read in WLAN Firmware

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation

Improper handling of resource allocation in virtual machines can lead to information exposure in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile,…

Information disclosure when Video engine escape input data is less than expected minimum size

information disclosure while invoking calibration data from user space to update firmware size

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware

Information disclosure while sending implicit broadcast containing APP launch information

Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message