Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 485

CVE-2024-33036

Use of Out-of-range Pointer Offset in Camera Driver

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
C-v2x 9150 C-v2x 9150 Firmware Fastconnect 6800 and 103 more
CVE-2024-23368

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Qualcomm IPC

Memory corruption when allocating and accessing an entry in an SMEM partition.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Apq8064au Apq8064au Firmware Aqt1000 and 683 more
CVE-2023-33020

Improper Authorization in WLAN Host

Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
205 205 Firmware 215 and 161 more
CVE-2023-33019

Improper Authorization in WLAN Host

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
205 205 Firmware 215 and 190 more
CVE-2023-28577

Multiple Dmabuf Kernel Address UAF Vulnerability

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 63 more
CVE-2023-28576

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel Driver

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Fastconnect 6800 Fastconnect 6800 Firmware Fastconnect 6900 and 59 more
CVE-2023-28575

Multiple Type Confusion Vulnerability

The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
205 205 Firmware 215 and 117 more